Apache

Products

Exploited and recent CVEs

• CVE-2020-1956 High 8.8 Exploited Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without 97.4%
• CVE-2020-1938 Critical 9.8 Exploited When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HT 99.3%
• CVE-2019-0193 High 7.2 Exploited In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "da 83.5%
• CVE-2019-0211 High 7.8 Exploited In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process script 65.0%
• CVE-2025-58712 Medium 6.4 Amq: privilege escalation via excessive /etc/passwd permissions 0.2%
• CVE-2024-42362 High 8.8 GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import 1.3%
• CVE-2024-42361 High 7.5 GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull} 1.1%
• CVE-2021-32824 Critical 9.8 Regular expression Denial of Service in MooTools 3.4%
• CVE-2021-25958 Medium 6.5 Generation of Error Message Containing Sensitive Information in Apache OFBiz 2.6%
• CVE-2020-11996 Unrated A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient n 26.7%
• CVE-2020-9482 Unrated If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication token on the client side but not on the serv 2.7%
• CVE-2020-9481 Unrated Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack. 2.4%
• CVE-2020-1952 Unrated An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely. 2.7%
• CVE-2020-9488 Low 3.7 Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messa 8.2%
• CVE-2020-1927 Unrated In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL 56.7%
• CVE-2020-1958 Unrated When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if 4.6%
• CVE-2020-1954 Unrated Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘ property of the default InstrumentationMan 6.1%
• CVE-2020-1934 Unrated In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server. 52.0%
• CVE-2020-1943 Unrated Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07. 97.2%
• CVE-2020-1950 Unrated A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23. 3.0%
• CVE-2020-1953 Unrated Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration v 6.3%
• CVE-2020-1935 Unrated In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as val 9.4%
• CVE-2020-1937 Unrated Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries. 3.1%
• CVE-2020-1929 Unrated The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables tr 1.0%