Vulnerabilities > Apache
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-09-26 | CVE-2018-11782 | Improper Input Validation vulnerability in Apache Subversion In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. | 4.0 |
| 2019-09-25 | CVE-2019-10098 | Open Redirect vulnerability in Apache Http Server In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. | 6.1 |
| 2019-09-23 | CVE-2019-12407 | Cross-site Scripting vulnerability in Apache Jspwiki On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. | 4.3 |
| 2019-09-23 | CVE-2019-10090 | Cross-site Scripting vulnerability in Apache Jspwiki On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. | 4.3 |
| 2019-09-23 | CVE-2019-12404 | Cross-site Scripting vulnerability in Apache Jspwiki On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContent.jsp, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. | 4.3 |
| 2019-09-23 | CVE-2019-10089 | Cross-site Scripting vulnerability in Apache Jspwiki On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. | 4.3 |
| 2019-09-23 | CVE-2019-10087 | Cross-site Scripting vulnerability in Apache Jspwiki On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. | 4.3 |
| 2019-09-16 | CVE-2019-10071 | Information Exposure Through Discrepancy vulnerability in Apache Tapestry 5.4.0 The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. | 9.8 |
| 2019-09-16 | CVE-2019-0207 | Path Traversal vulnerability in Apache Tapestry 5.4.0 Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform. | 7.5 |
| 2019-09-16 | CVE-2019-0195 | Deserialization of Untrusted Data vulnerability in Apache Tapestry 5.4.0 Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. | 9.8 |