Apache Known Exploited Vulnerabilities

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to...

Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

Unsafe deserialization in Apache OFBiz

Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.

Apache Flink directory traversal attack: remote file writing through the REST API

Apache OFBiz: Arbitrary file properties reading and SSRF attack

Apache ShenYu Admin bypass JWT authentication

When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to...

Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present

Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the...

Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE

Remote Code Execution in Apache Unomi

PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of...

Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of...

The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK...

Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before...

RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

Bypass of the fix for CVE-2019-0195

Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by...