Vulnerabilities > Apache > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-01-16 | CVE-2022-45438 | Exposure of Resource to Wrong Sphere vulnerability in Apache Superset When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0. | 5.3 |
| 2023-01-09 | CVE-2022-46769 | Cross-site Scripting vulnerability in Apache Sling CMS An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in the site group feature. Upgrade to Apache Sling App CMS >= 1.1.4 | 5.4 |
| 2023-01-06 | CVE-2022-45787 | Cleartext Storage of Sensitive Information vulnerability in Apache James Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. | 5.5 |
| 2023-01-06 | CVE-2022-45935 | Exposure of Resource to Wrong Sphere vulnerability in Apache James Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. | 5.5 |
| 2022-12-19 | CVE-2022-40743 | Cross-site Scripting vulnerability in Apache Traffic Server Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This issue affects Apache Traffic Server: 9.0.0 to 9.1.3. | 6.1 |
| 2022-12-19 | CVE-2022-37392 | Improper Check for Unusual or Exceptional Conditions vulnerability in Apache Traffic Server Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. | 5.3 |
| 2022-12-19 | CVE-2022-47500 | Open Redirect vulnerability in Apache Helix 0.9.10/0.9.9 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4. Solution: removed the the forward component since it was improper designed for UI embedding. User please upgrade to 1.1.0 to fix this issue. | 6.1 |
| 2022-12-16 | CVE-2021-28655 | Improper Input Validation vulnerability in Apache Zeppelin The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files. | 6.5 |
| 2022-12-16 | CVE-2022-46870 | Cross-site Scripting vulnerability in Apache Zeppelin An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers. This issue affects Apache Zeppelin before 0.8.2. | 5.4 |
| 2022-12-15 | CVE-2022-32531 | Improper Certificate Validation vulnerability in Apache Bookkeeper The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. | 5.9 |