Vulnerabilities > Apache
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-11-19 | CVE-2021-39233 | Unspecified vulnerability in Apache Ozone In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client. | 9.1 |
| 2021-11-19 | CVE-2021-39234 | Incorrect Authorization vulnerability in Apache Ozone In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL. | 4.9 |
| 2021-11-19 | CVE-2021-39235 | Incorrect Permission Assignment for Critical Resource vulnerability in Apache Ozone In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. | 6.5 |
| 2021-11-19 | CVE-2021-39236 | Missing Authorization vulnerability in Apache Ozone In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user. | 8.8 |
| 2021-11-19 | CVE-2021-41532 | Unspecified vulnerability in Apache Ozone In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. | 5.0 |
| 2021-11-17 | CVE-2021-42250 | Improper Encoding or Escaping of Output vulnerability in Apache Superset Improper output neutralization for Logs. | 4.0 |
| 2021-11-16 | CVE-2021-37580 | Improper Authentication vulnerability in Apache Shenyu 2.3.0/2.4.0 A flaw was found in Apache ShenYu Admin. | 7.5 |
| 2021-11-12 | CVE-2021-41972 | Unspecified vulnerability in Apache Superset Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. | 4.0 |
| 2021-11-11 | CVE-2021-43350 | Injection vulnerability in Apache Traffic Control An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter. | 7.5 |
| 2021-11-11 | CVE-2021-26558 | Deserialization of Untrusted Data vulnerability in Apache Shardingsphere-Ui 4.1.1 Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. | 5.0 |