VYPR
← Apache

Vendor CVEs

Apache

All CVEs

3,584 total · sorted by risk
  • CVE-2013-1968Jul 31, 2013
    Apache
    Subversion
    risk 0.00cvss —epss 0.03

    Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service (FSFS repository corruption) via a newline character in a file name.

  • CVE-2013-4002Jul 23, 2013
    Apache
    Xerces2 Java
    risk 0.00cvss —epss 0.25

    XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java…

  • CVE-2013-1879Jul 20, 2013
    Apache
    Activemq
    risk 0.00cvss —epss 0.07

    Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."

  • CVE-2013-2135Jul 16, 2013
    Apache
    Struts
    risk 0.00cvss —epss 0.14

    Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

  • CVE-2013-1777Jul 11, 2013
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.10

    The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using…

  • CVE-2013-1768Jul 11, 2013
    Apache
    Openjpa
    risk 0.00cvss —epss 0.10

    The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute…

  • CVE-2013-1896Jul 10, 2013
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.29

    mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn…

  • CVE-2013-1965Jul 10, 2013
    Apache
    Struts
    risk 0.00cvss —epss 0.94

    Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

  • CVE-2013-1862Jun 10, 2013
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.25

    mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a…

  • CVE-2013-1845May 2, 2013
    Apache
    Subversion
    risk 0.00cvss —epss 0.06

    The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.

  • CVE-2013-3060Apr 21, 2013
    Apache
    Activemq
    risk 0.00cvss —epss 0.06

    The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.

  • CVE-2012-6551Apr 21, 2013
    Apache
    Activemq
    risk 0.00cvss —epss 0.08

    The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.

  • CVE-2012-6092Apr 21, 2013
    Apache
    Activemq
    risk 0.00cvss —epss 0.07

    Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher),…

  • CVE-2013-0253Apr 9, 2013
    Apache
    Maven
    risk 0.00cvss —epss 0.02

    The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.

  • CVE-2013-0248Mar 15, 2013
    Apache
    Commons Fileupload
    risk 0.00cvss —epss 0.01

    The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.

  • CVE-2012-4460Mar 14, 2013
    Apache
    Qpid
    risk 0.00cvss —epss 0.03

    The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read,…

  • CVE-2012-4446Mar 14, 2013
    Apache
    Qpid
    risk 0.00cvss —epss 0.05

    The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.

  • CVE-2013-0239Mar 12, 2013
    Apache
    Cxf
    risk 0.00cvss —epss 0.05

    Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password…

  • CVE-2012-5633Mar 12, 2013
    Apache
    Cxf
    risk 0.00cvss —epss 0.08

    The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.

  • CVE-2012-4558Feb 26, 2013
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.23

    Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject…

  • CVE-2012-3499Feb 26, 2013
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.23

    Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3)…

  • CVE-2012-5616Jan 22, 2013
    Apache
    Cloudstack
    risk 0.00cvss —epss 0.01

    Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of…

  • CVE-2012-2378Jan 5, 2013
    Apache
    Cxf
    risk 0.00cvss —epss 0.04

    Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3)…

  • CVE-2012-2379Jan 3, 2013
    Apache
    Cxf
    risk 0.00cvss —epss 0.04

    Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.

  • CVE-2012-3546Dec 19, 2012
    Apache
    Tomcat
    risk 0.00cvss —epss 0.12

    org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at…

  • CVE-2012-5786Nov 4, 2012
    Apache
    Cxf
    risk 0.00cvss —epss 0.01

    The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF before 2.7.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate,…

  • CVE-2012-5785Nov 4, 2012
    Apache
    Axis2
    risk 0.00cvss —epss 0.02

    Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

  • CVE-2012-5784Nov 4, 2012
    Apache
    Axis
    risk 0.00cvss —epss 0.06

    Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's…

  • CVE-2012-5351Oct 9, 2012
    Apache
    Axis2
    risk 0.00cvss —epss 0.05

    Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.

  • CVE-2012-4418Oct 9, 2012
    Apache
    Axis2
    risk 0.00cvss —epss 0.06

    Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."

  • CVE-2012-2145Sep 28, 2012
    Apache
    Qpid
    risk 0.00cvss —epss 0.04

    Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of incomplete connections.

  • CVE-2012-3451Sep 24, 2012
    Apache
    Cxf
    risk 0.00cvss —epss 0.09

    Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.

  • CVE-2012-3373Sep 19, 2012
    Apache
    Wicket
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app.

  • CVE-2012-4387Sep 5, 2012
    Apache
    Struts
    risk 0.00cvss —epss 0.08

    Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.

  • CVE-2012-4386Sep 5, 2012
    Apache
    Struts
    risk 0.00cvss —epss 0.03

    The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session…

  • CVE-2012-0213Aug 7, 2012
    Apache
    Poi
    risk 0.00cvss —epss 0.07

    The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition…

  • CVE-2012-3376Jul 12, 2012
    Apache
    Hadoop
    risk 0.00cvss —epss 0.03

    DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have…

  • CVE-2012-2138Jul 9, 2012
    Apache
    Sling Servlets Post
    risk 0.00cvss —epss 0.14

    The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted…

  • CVE-2012-2098Jun 29, 2012
    Apache
    Commons Compress
    risk 0.00cvss —epss 0.13

    Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.

  • CVE-2012-2381Jun 26, 2012
    Apache
    Roller
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role.

  • CVE-2012-2380Jun 26, 2012
    Apache
    Roller
    risk 0.00cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by leveraging the HTTP POST functionality.

  • CVE-2011-3620May 3, 2012
    Apache
    Qpid
    risk 0.00cvss —epss 0.05

    Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.

  • CVE-2012-0883Apr 18, 2012
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.01

    envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.

  • CVE-2012-1574Apr 12, 2012
    Apache
    Hadoop
    risk 0.00cvss —epss 0.05

    The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote…

  • CVE-2012-0256Mar 26, 2012
    Apache
    trafficserver
    risk 0.00cvss —epss 0.03

    Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header.

  • CVE-2012-1089Mar 23, 2012
    Apache
    Wicket
    risk 0.00cvss —epss 0.05

    Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a Wicket resource that corresponds to a null package.

  • CVE-2012-0047Mar 23, 2012
    Apache
    Wicket
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the wicket:pageMapName parameter.

  • CVE-2012-1181Mar 19, 2012
    Apache
    Mod Fcgid
    risk 0.00cvss —epss 0.05

    fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server does not recognize the FcgidMaxProcessesPerClass directive for a virtual host, which makes it easier for remote attackers to cause a denial of service (memory consumption) via a series of HTTP requests…

  • CVE-2012-0838Mar 2, 2012
    Apache
    Struts
    risk 0.00cvss —epss 0.14

    Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.

  • CVE-2012-0022Jan 19, 2012
    Apache
    Tomcat
    risk 0.00cvss —epss 0.10

    Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a…

Page 68 of 72