Vulnerabilidades em Apache Software Foundation

2.345 resultados
Análise Vexday

O portfólio da Apache Software Foundation acumula 1.872 CVEs catalogadas, das quais 215 são de severidade crítica e 83 contam com prova de conceito pública — fatores que ampliam a superfície de risco operacional para equipes de segurança. A taxa de exploração ativa é especialmente preocupante: 28 vulnerabilidades constam no catálogo KEV da CISA, representando uma proporção 3,3 vezes acima da média geral do catálogo, o que indica atenção consistente de agentes maliciosos ao ecossistema Apache. A falha mais comum é CWE-20 (validação inadequada de entrada), padrão estrutural que tende a se manifestar em múltiplos produtos e versões, exigindo revisão ampla e não pontual. Destaque para CVE-2021-40438, a vulnerabilidade de maior risco ativo no momento, com EPSS máximo de 1,0 — probabilidade de exploração na prática praticamente certa —, o que a torna prioridade imediata de remediação para qualquer organização que opere componentes Apache afetados.

CVE-2024-56325CRITICALApache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not requiredEPSS 80.2%CVE-2016-8740—The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrictEPSS 79.1%CVE-2022-23944—Apache ShenYu 2.4.1 Improper access controlEPSS 79.0%CVE-2022-24288—Apache Airflow: RCE in example DAGsEPSS 77.9%CVE-2019-0192—In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By poEPSS 77.5%CVE-2021-41303—Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypassEPSS 76.7%CVE-2023-32007HIGHApache Spark: Shell command injection via Spark UIEPSS 76.0%CVE-2021-33037—Incorrect Transfer-Encoding handling with HTTP/1.0EPSS 75.4%CVE-2022-29885—EncryptInterceptor does not provide complete protection on insecure networksEPSS 73.5%CVE-2025-29891MEDIUMApache Camel: Camel Message Header Injection through request parametersEPSS 73.4%CVE-2017-5637—Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, wEPSS 73.1%CVE-2020-13945—In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allEPSS 73.0%CVE-2023-43622—Apache HTTP Server: DoS in HTTP/2 with initial windows size 0EPSS 70.6%CVE-2024-53677CRITICALApache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checksEPSS 70.1%CVE-2017-12616—When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source codeEPSS 70.1%CVE-2018-1303—A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while EPSS 69.8%CVE-2024-38472HIGHApache HTTP Server on WIndows UNC SSRFEPSS 69.5%CVE-2024-43441CRITICALApache HugeGraph-Server: Fixed JWT Token(Secret)EPSS 69.4%CVE-2022-22719—mod_lua Use of uninitialized value of in r:parsebodyEPSS 69.1%CVE-2019-17571CRITICALIncluded in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exeEPSS 69.1%