Vulnerabilidades en Apache Software Foundation

1877 resultados
Análisis Vexday

O portfólio da Apache Software Foundation acumula 1.872 CVEs catalogadas, das quais 215 são de severidade crítica e 83 contam com prova de conceito pública — fatores que ampliam a superfície de risco operacional para equipes de segurança. A taxa de exploração ativa é especialmente preocupante: 28 vulnerabilidades constam no catálogo KEV da CISA, representando uma proporção 3,3 vezes acima da média geral do catálogo, o que indica atenção consistente de agentes maliciosos ao ecossistema Apache. A falha mais comum é CWE-20 (validação inadequada de entrada), padrão estrutural que tende a se manifestar em múltiplos produtos e versões, exigindo revisão ampla e não pontual. Destaque para CVE-2021-40438, a vulnerabilidade de maior risco ativo no momento, com EPSS máximo de 1,0 — probabilidade de exploração na prática praticamente certa —, o que a torna prioridade imediata de remediação para qualquer organização que opere componentes Apache afetados.

CVE-2017-15701—In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frameEPSS 4.4%CVE-2021-23901—An XML external entity (XXE) injection vulnerability exists in the Nutch DmozParserEPSS 4.4%CVE-2021-41973—Apache MINA HTTP listener DOSEPSS 4.3%CVE-2020-17513—In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.EPSS 4.3%CVE-2022-23223—Apache ShenYu Password leakageEPSS 4.3%CVE-2022-26612—Arbitrary file write in FileUtil#unpackEntries on WindowsEPSS 4.3%CVE-2021-23937—DNS proxy and possible amplification attackEPSS 4.3%CVE-2018-8020—Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lisEPSS 4.2%CVE-2017-7676—Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can reEPSS 4.2%CVE-2021-30179—Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filterEPSS 4.2%CVE-2025-31651CRITICALApache Tomcat: Bypass of rules in Rewrite ValveEPSS 4.2%CVE-2017-9795—When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster mEPSS 4.2%CVE-2024-40725MEDIUMApache HTTP Server: source code disclosure with handlers configured via AddTypeEPSS 4.1%CVE-2018-17198—Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies EPSS 4.1%CVE-2017-5662—In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send malicioEPSS 4.1%CVE-2021-37578—Remote code execution via RMIEPSS 4.1%CVE-2018-8019—When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This alloEPSS 4.1%CVE-2024-42323HIGHApache HertzBeat: RCE by snakeYaml deser load malicious xmlEPSS 4.1%CVE-2020-13924—In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other directEPSS 4.0%CVE-2022-29599—Commandline class shell injection vulnerabilitiesEPSS 4.0%