Mọi CVE đã công bố cùng các advisory mã nguồn mở (NVD, OSV, GitHub), kèm CVSS, EPSS và cho biết lỗ hổng có đang bị khai thác thực tế hay không (CISA KEV). Cập nhật mỗi vài giờ. Các bài quét đối chiếu dữ liệu này với công nghệ phát hiện được trên site.
| 13/07/2022 |
| CVE-2022-28889 | TRUNG BÌNH4.3 | In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header. | 07/07/2022 |
| CVE-2021-44791 | TRUNG BÌNH6.1 | In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks. | 07/07/2022 |
| CVE-2022-33980 | NGHIÊM TRỌNG9.8 | Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starti | 06/07/2022 |
| CVE-2021-37839 | TRUNG BÌNH4.3 | Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics. | 06/07/2022 |
| CVE-2022-32533 | NGHIÊM TRỌNG9.8 | Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provid | 06/07/2022 |
| CVE-2022-32532 | NGHIÊM TRỌNG9.8 | Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass. | 29/06/2022 |
| CVE-2022-33879 | THẤP3.3 | The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1. | 27/06/2022 |
| CVE-2022-26477 | CAO7.5 | The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a "low-priority but useful impro | 27/06/2022 |
| CVE-2022-34305 | TRUNG BÌNH6.1 | In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability. | 23/06/2022 |
| CVE-2022-32549 | TRUNG BÌNH5.3 | Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files. | 22/06/2022 |
| CVE-2022-33140 | CAO8.8 | The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the default configuration. | 15/06/2022 |
| CVE-2021-33036 | CAO8.8 | In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher. | 15/06/2022 |
| CVE-2022-25167 | NGHIÊM TRỌNG9.8 | Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol. | 14/06/2022 |
| CVE-2021-37404 | NGHIÊM TRỌNG9.8 | There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher. | 13/06/2022 |
| CVE-2022-31813 | NGHIÊM TRỌNG9.8 | Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. | 09/06/2022 |
| CVE-2022-30556 | CAO7.5 | Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. | 09/06/2022 |
| CVE-2022-30522 | CAO7.5 | If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. | 09/06/2022 |