Vulnerabilidades em Apache Software Foundation

2.334 resultados
Análise Vexday

O portfólio da Apache Software Foundation acumula 1.872 CVEs catalogadas, das quais 215 são de severidade crítica e 83 contam com prova de conceito pública — fatores que ampliam a superfície de risco operacional para equipes de segurança. A taxa de exploração ativa é especialmente preocupante: 28 vulnerabilidades constam no catálogo KEV da CISA, representando uma proporção 3,3 vezes acima da média geral do catálogo, o que indica atenção consistente de agentes maliciosos ao ecossistema Apache. A falha mais comum é CWE-20 (validação inadequada de entrada), padrão estrutural que tende a se manifestar em múltiplos produtos e versões, exigindo revisão ampla e não pontual. Destaque para CVE-2021-40438, a vulnerabilidade de maior risco ativo no momento, com EPSS máximo de 1,0 — probabilidade de exploração na prática praticamente certa —, o que a torna prioridade imediata de remediação para qualquer organização que opere componentes Apache afetados.

CVE-2018-1340—Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, whEPSS 2.1%CVE-2024-52317MEDIUMApache Tomcat: Request/response mix-up with HTTP/2EPSS 2.1%CVE-2017-5663—In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read EPSS 2.1%CVE-2023-26031HIGHPrivilege escalation in Apache Hadoop Yarn container-executor binary on Linux systemsEPSS 2.1%CVE-2025-54539CRITICALApache ActiveMQ NMS AMQP Client: Deserialization of Untrusted DataEPSS 2.1%CVE-2018-1292—Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL EPSS 2.1%CVE-2021-45458—Hardcoded credentialsEPSS 2.1%CVE-2022-23974—Pinot segment push endpoint has a vulnerability in unprotected environmentsEPSS 2.1%CVE-2017-12622—When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh EPSS 2.1%CVE-2023-34478CRITICALApache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.EPSS 2.1%CVE-2021-25640—Open Redirect or SSRF vulnerability usage of parseURLEPSS 2.1%CVE-2016-6815—In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role.EPSS 2.1%CVE-2022-40604HIGHFormat String VulnerabilityEPSS 2.1%CVE-2023-30776MEDIUMApache Superset: Database connection password leakEPSS 2.1%CVE-2023-28707HIGHAirflow Apache Drill Provider Arbitrary File Read VulnerabilityEPSS 2.1%CVE-2017-5655—In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari Server host. The tempoEPSS 2.1%CVE-2025-52520HIGHApache Tomcat: DoS via integer overflow in multipart file uploadEPSS 2.1%CVE-2025-29953CRITICALApache ActiveMQ NMS OpenWire Client: deserialization allowlist bypassEPSS 2.1%CVE-2024-29131HIGHApache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()EPSS 2.1%CVE-2017-3154—Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.EPSS 2.1%