Apache Software Foundation vulnerabilities
Published CVEs affecting Apache Software Foundation products: 1280 record(s), with severity, exploitation and fixes.
Tomcat 124Thrift 86Airflow 72Camel 58Apache HTTP Server 54Traffic Server 43Apache ActiveMQ 41Cxf 38Syncope 34Apisix 29Cloudstack 29Struts 27Ofbiz 24Dolphinscheduler 23Apache ActiveMQ All 20Kylin 19Apache Roller 18Nifi 17Iotdb 16Apache ActiveMQ Broker 15Wicket 15Answer 14Mina Sshd 14Allura 13Qpid Broker-j 13Ranger 12Log4j 11Shiro 11Jmeter 11Neethi 11Inlong 10Fory 10Artemis 10Nimble 10Apache ActiveMQ Artemis 9Superset 8Apache-airflow-providers-fab 8Openoffice 8Zookeeper 8Karaf 8
CVE-2012-5887
Medium · 5.0
CWE-287 Nov 17, 2012
Improper Authentication in Apache Software Foundation Tomcat
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
CVE-2012-5886
Medium · 5.0
CWE-287 Nov 17, 2012
Improper Authentication in Apache Software Foundation Tomcat
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
CVE-2012-5885
Medium · 5.0
CWE-264 Nov 17, 2012
Permissions, Privileges, and Access Controls in Apache Software Foundation Tomcat
The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.
CVE-2012-0391
Critical · 9.8
KEV Urgent · 83 Public exploit CWE-94 Jan 8, 2012
Apache Struts 2 Improper Input Validation Vulnerability
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
CVE-2006-1547
High · 7.5
KEV High · 59 CWE-749 Mar 30, 2006
Apache Struts 1 ActionForm Denial-of-Service Vulnerability
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.