Vulnerabilidades em Apache Software Foundation

2.370 resultados
Análise Vexday

O portfólio da Apache Software Foundation acumula 1.872 CVEs catalogadas, das quais 215 são de severidade crítica e 83 contam com prova de conceito pública — fatores que ampliam a superfície de risco operacional para equipes de segurança. A taxa de exploração ativa é especialmente preocupante: 28 vulnerabilidades constam no catálogo KEV da CISA, representando uma proporção 3,3 vezes acima da média geral do catálogo, o que indica atenção consistente de agentes maliciosos ao ecossistema Apache. A falha mais comum é CWE-20 (validação inadequada de entrada), padrão estrutural que tende a se manifestar em múltiplos produtos e versões, exigindo revisão ampla e não pontual. Destaque para CVE-2021-40438, a vulnerabilidade de maior risco ativo no momento, com EPSS máximo de 1,0 — probabilidade de exploração na prática praticamente certa —, o que a torna prioridade imediata de remediação para qualquer organização que opere componentes Apache afetados.

CVE-2023-25692HIGHApache Airflow Google Provider: Google Cloud Sql Provider Denial Of ServiceEPSS 1.8%CVE-2025-48734HIGHApache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by defaultEPSS 1.8%CVE-2017-5658—The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This cEPSS 1.8%CVE-2021-42250—Possible log injectionEPSS 1.8%CVE-2022-36127—Service unavailability impact in NodeJS agent(version <= 0.5.0)EPSS 1.8%CVE-2023-27603CRITICALApache Linkis Mangaer module engineConn material upload exists Zip Slip issueEPSS 1.8%CVE-2017-7680—Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains.EPSS 1.8%CVE-2017-9806—A vulnerability in the OpenOffice Writer DOC file parser before 4.1.4, and specifically in the WW8Fonts Constructor, allows attackers to craEPSS 1.8%CVE-2023-48291—Apache Airflow: Improper access control to DAG resourcesEPSS 1.8%CVE-2017-7669—In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input valiEPSS 1.8%CVE-2023-46819MEDIUMApache OFBiz: Execution of Solr plugin queries without authenticationEPSS 1.8%CVE-2022-24969—bypass of CVE-2021-25640EPSS 1.8%CVE-2023-22887—Apache Airflow path traversal by authenticated userEPSS 1.8%CVE-2021-43999—Improper validation of SAML responsesEPSS 1.8%CVE-2024-39864CRITICALApache CloudStack: Integration API service uses dynamic port when disabledEPSS 1.8%CVE-2022-37401—Apache OpenOffice Weak Master KeysEPSS 1.8%CVE-2023-39410—Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDKEPSS 1.8%CVE-2020-11983—An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBACEPSS 1.8%CVE-2022-34321HIGHApache Pulsar: Improper Authentication for Pulsar Proxy Statistics EndpointEPSS 1.8%CVE-2021-41971—Possible SQL Injection when template processing is enabledEPSS 1.8%