Vulnerabilidades em Apache Software Foundation

2.378 resultados
Análise Vexday

O portfólio da Apache Software Foundation acumula 1.872 CVEs catalogadas, das quais 215 são de severidade crítica e 83 contam com prova de conceito pública — fatores que ampliam a superfície de risco operacional para equipes de segurança. A taxa de exploração ativa é especialmente preocupante: 28 vulnerabilidades constam no catálogo KEV da CISA, representando uma proporção 3,3 vezes acima da média geral do catálogo, o que indica atenção consistente de agentes maliciosos ao ecossistema Apache. A falha mais comum é CWE-20 (validação inadequada de entrada), padrão estrutural que tende a se manifestar em múltiplos produtos e versões, exigindo revisão ampla e não pontual. Destaque para CVE-2021-40438, a vulnerabilidade de maior risco ativo no momento, com EPSS máximo de 1,0 — probabilidade de exploração na prática praticamente certa —, o que a torna prioridade imediata de remediação para qualquer organização que opere componentes Apache afetados.

CVE-2016-8737—In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web sitEPSS 1.3%CVE-2022-26885HIGHApache DolphinScheduler config file read by task riskEPSS 1.3%CVE-2024-47554MEDIUMApache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReaderEPSS 1.3%CVE-2023-24997CRITICALApache InLong: Jdbc Connection Security BypassEPSS 1.3%CVE-2022-37435—Apache ShenYu Admin Improper Privilege ManagementEPSS 1.3%CVE-2024-23953MEDIUMApache Hive: Timing Attack Against Signature in LLAP utilEPSS 1.3%CVE-2018-8028—An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an EPSS 1.3%CVE-2024-31868MEDIUMApache Zeppelin: XSS vulnerability in the helium moduleEPSS 1.3%CVE-2022-45802CRITICALApache StreamPark (incubating): Upload any file to any directoryEPSS 1.3%CVE-2023-50270MEDIUMApache DolphinScheduler: Session do not expire after password changeEPSS 1.3%CVE-2023-31103HIGHApache InLong: Attackers can change the immutable name and type of clusterEPSS 1.3%CVE-2021-36152—Insecure TrustManager used in LDAP connectionsEPSS 1.3%CVE-2025-61733HIGHApache Kylin: Authentication bypassEPSS 1.3%CVE-2022-32749HIGHApache Traffic Server: Improperly handled requests can cause crashes in specific pluginsEPSS 1.3%CVE-2022-42466MEDIUMXSS vulnerability, eg for String properties.EPSS 1.3%CVE-2023-35887MEDIUMApache MINA SSHD: Information disclosure bugs with RootedFilesystemEPSS 1.3%CVE-2025-54813MEDIUMApache Log4cxx: Improper escaping with JSONLayoutEPSS 1.3%CVE-2023-25196—Apache Fineract: SQL injection vulnerability EPSS 1.3%CVE-2023-49733—Apache Cocoon's StreamGenerator is vulnerable to XXE injectionEPSS 1.3%CVE-2024-23538CRITICALApache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.EPSS 1.3%