Vulnerabilities > Apache > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-11-07 | CVE-2023-46819 | Missing Authentication for Critical Function vulnerability in Apache Ofbiz Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are recommended to upgrade to version 18.12.09 | 5.3 |
| 2023-11-07 | CVE-2023-46851 | External Control of File Name or Path vulnerability in Apache Allura Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. | 4.9 |
| 2023-10-23 | CVE-2023-46288 | Unspecified vulnerability in Apache Airflow Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for configuration even when the expose_config option is set to non-sensitive-only. | 4.3 |
| 2023-10-23 | CVE-2023-45802 | Resource Exhaustion vulnerability in multiple products When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. | 5.9 |
| 2023-10-20 | CVE-2023-44483 | Information Exposure Through Log Files vulnerability in Apache Santuario XML Security for Java All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue. | 6.5 |
| 2023-10-19 | CVE-2023-25753 | Server-Side Request Forgery (SSRF) vulnerability in Apache Shenyu 2.5.1 There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. | 6.5 |
| 2023-10-16 | CVE-2023-43666 | Insufficient Verification of Data Authenticity vulnerability in Apache Inlong Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, General user can view all user data like Admin account. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8623 | 6.5 |
| 2023-10-16 | CVE-2023-45757 | Cross-site Scripting vulnerability in Apache Brpc Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page. An attacker that can send http request to bRPC server with rpcz enabled can inject arbitrary XSS code to the builtin rpcz page. Solution (choose one of three): 1. | 6.1 |
| 2023-10-14 | CVE-2023-42663 | Unspecified vulnerability in Apache Airflow Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability. | 6.5 |
| 2023-10-14 | CVE-2023-42780 | Information Exposure vulnerability in Apache Airflow Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. | 6.5 |