Vulnerabilities > Apache
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-06-19 | CVE-2020-9495 | Injection vulnerability in Apache Archiva Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. | 5.3 |
| 2020-06-15 | CVE-2020-11969 | Missing Authentication for Critical Function vulnerability in Apache Tomee If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. | 9.8 |
| 2020-06-12 | CVE-2020-11980 | Server-Side Request Forgery (SSRF) vulnerability in Apache Karaf In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. | 6.3 |
| 2020-06-05 | CVE-2020-11975 | Unspecified vulnerability in Apache Unomi 1.3.0/1.4.0/1.5.0 Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process. | 9.8 |
| 2020-06-03 | CVE-2020-1963 | Missing Authorization vulnerability in Apache Ignite Apache Ignite uses H2 database to build SQL distributed execution engine. | 9.1 |
| 2020-05-22 | CVE-2020-1956 | OS Command Injection vulnerability in Apache Kylin Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation. | 8.8 |
| 2020-05-21 | CVE-2018-21234 | Deserialization of Untrusted Data vulnerability in multiple products Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set. | 9.8 |
| 2020-05-20 | CVE-2020-9484 | Deserialization of Untrusted Data vulnerability in multiple products When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. | 7.0 |
| 2020-05-20 | CVE-2020-1955 | Missing Authentication for Critical Function vulnerability in Apache Couchdb 3.0.0 CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valid_user_except_for_up`. | 9.8 |
| 2020-05-14 | CVE-2020-1960 | Unspecified vulnerability in Apache Flink A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0) where, when running a process with an enabled JMXReporter, with a port configured via metrics.reporter.reporter_name>.port, an attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a specially crafted request to rebind the JMXRMI registry to one under the attacker's control. | 4.7 |