Vulnerabilidades em Apache Software Foundation

2.370 resultados
Análise Vexday

O portfólio da Apache Software Foundation acumula 1.872 CVEs catalogadas, das quais 215 são de severidade crítica e 83 contam com prova de conceito pública — fatores que ampliam a superfície de risco operacional para equipes de segurança. A taxa de exploração ativa é especialmente preocupante: 28 vulnerabilidades constam no catálogo KEV da CISA, representando uma proporção 3,3 vezes acima da média geral do catálogo, o que indica atenção consistente de agentes maliciosos ao ecossistema Apache. A falha mais comum é CWE-20 (validação inadequada de entrada), padrão estrutural que tende a se manifestar em múltiplos produtos e versões, exigindo revisão ampla e não pontual. Destaque para CVE-2021-40438, a vulnerabilidade de maior risco ativo no momento, com EPSS máximo de 1,0 — probabilidade de exploração na prática praticamente certa —, o que a torna prioridade imediata de remediação para qualquer organização que opere componentes Apache afetados.

CVE-2019-17563—When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where anEPSS 10.7%CVE-2021-35517—Apache Commons Compress 1.1 to 1.20 denial of service vulnerabilityEPSS 10.6%CVE-2016-8749—Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.EPSS 10.6%CVE-2018-8038—Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity ProviderEPSS 10.6%CVE-2018-8032—Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.EPSS 10.6%CVE-2017-9787—When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache StruEPSS 10.6%CVE-2016-5018—In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application EPSS 10.3%CVE-2021-29425—Possible limited path traversal vulnerabily in Apache Commons IOEPSS 10.2%CVE-2022-47501HIGHApache OFBiz: Arbitrary file reading vulnerabilityEPSS 10.2%CVE-2017-12626HIGHApache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, EPSS 10.1%CVE-2017-7675—The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented dirEPSS 10.1%CVE-2025-55754CRITICALApache Tomcat: console manipulation via escape sequences in log messagesEPSS 10.1%CVE-2026-27446CRITICALApache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationEPSS 10.0%CVE-2020-17531—Deserialization flaw in EOL Tapestry 4.EPSS 10.0%CVE-2018-1297—When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to geEPSS 9.9%CVE-2021-30640—Auth weakness in JNDIRealmEPSS 9.9%CVE-2018-8041—Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.EPSS 9.8%CVE-2017-7672—If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will EPSS 9.8%CVE-2018-1283—In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the defaEPSS 9.7%CVE-2019-0201—An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permisEPSS 9.7%