CVE Vulnerability Advisory Database

[Affected Scope] Inactive Apache MINA 3.0.0 branch and applications utilizing its codec module

[Impact] Unrestricted Remote Code Execution (RCE) via gadget chains due to unfiltered deserialization of frame bytes from untrusted peers

[Mitigation] Decommission the unsupported 3.0.0 branch and migrate to the actively maintained Apache MINA 2.2.X branch

[Affected Scope] Apache Tomcat versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, 9.0.0.M1 through 9.0.98, and EOL 8.5.0 through 8.5.100.

[Impact] Attackers can bypass path validation via internal dot path equivalence, allowing them to inject malicious content into sensitive files or trigger remote code execution (RCE) via session deserialization.

[Mitigation] Immediately upgrade to patched versions (11.0.3, 10.1.35, or 9.0.99) and ensure the Default Servlet's 'readonly' parameter is set to 'true'.

[Affected Scope] Apache OFBiz versions up to and including 18.12.14

[Impact] Unauthenticated remote attackers can execute arbitrary screen rendering code and system commands by sending specially crafted HTTP requests

[Mitigation] Immediately upgrade Apache OFBiz to the latest stable version 18.12.15 or higher

[Affected Scope] Apache HTTP Server versions 2.4.59 and earlier, specifically environments utilizing mod_rewrite rules where substitutions in server context use backreferences or variables as the first segment.

[Impact] Attackers can map URLs to restricted filesystem locations, leading to unauthorized source code disclosure or arbitrary code execution (RCE).

[Mitigation] Immediately upgrade Apache HTTP Server to version 2.4.60 or later, and review/restrict unsafe RewriteRules.

[Affected Scope] PHP versions 8.1.x (before 8.1.29), 8.2.x (before 8.2.20), and 8.3.x (before 8.3.8) running on Windows with Apache and PHP-CGI configuration under specific system code pages

[Impact] Unauthenticated remote attackers can inject arbitrary command-line options into the PHP binary, leading to remote code execution (RCE) and source code disclosure

[Mitigation] Immediately upgrade to patched PHP versions (8.1.29, 8.2.20, 8.3.8 or later) or apply Apache Rewrite rules to block malicious query strings

[Affected Scope] Apache OFBiz versions prior to 18.12.13

[Impact] Unauthenticated remote attackers can bypass security filters via path traversal, access internal APIs, and execute arbitrary system commands (RCE) on the target server.

[Mitigation] Immediately upgrade Apache OFBiz to the official patched version 18.12.13 or later.

[Affected Scope] Apache HugeGraph-Server versions from 1.0.0 before 1.3.0 running on Java 8 & Java 11

[Impact] Unauthenticated remote attackers can bypass security controls and execute arbitrary system commands via the Gremlin query engine, leading to full system compromise

[Mitigation] Upgrade Apache HugeGraph-Server to version 1.3.0 or higher with Java 11, and ensure the Authentication system is enabled

[Affected Scope] Apache ActiveMQ brokers and client libraries utilizing the OpenWire protocol

[Impact] Unauthenticated remote attackers can execute arbitrary shell commands on the target system by manipulating serialized class types

[Mitigation] Immediately upgrade both brokers and clients to patched versions (5.15.16, 5.16.7, 5.17.6, or 5.18.3 and above)

[Affected Scope] Apache RocketMQ versions 5.1.0 and below, and versions 4.9.5 and below

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with the privileges of the RocketMQ process, leading to full system compromise

[Mitigation] Immediately upgrade to RocketMQ version 5.1.1 or above (for 5.x) or 4.9.6 or above (for 4.x)

[Affected Scope] Apache Superset installations up to and including version 2.0.1 that have not altered the default configured SECRET_KEY.

[Impact] Unauthorized attackers can forge session cookies to authenticate as administrators, leading to unauthorized resource access, database compromise, and potential Remote Code Execution (RCE).

[Mitigation] Immediately configure a unique, cryptographically strong, randomly generated SECRET_KEY in 'superset_config.py' or via environment variables.

[Affected Scope] Apache CouchDB installations prior to version 3.2.2

[Impact] Unauthenticated attackers can bypass authentication, gain administrative privileges, and execute arbitrary code via Erlang distribution ports

[Mitigation] Upgrade Apache CouchDB to version 3.2.2 or higher, and restrict access to Erlang ports (4369, 9100-9200) using a firewall

[Affected Scope] Apache APISIX versions 1.3 through 2.12.1 (including LTS versions prior to 2.10.4)

[Impact] Remote attackers can bypass IP restrictions on the Admin API and execute arbitrary code on the target server by exploiting default configurations

[Mitigation] Immediately upgrade Apache APISIX to version 2.12.1, 2.10.4 LTS, or later, and rotate default Admin Keys

[Affected Scope] Apache Log4j versions 2.0-beta9 to 2.15.0 (including 2.15.0 for Java 8 and 2.12.1 or below for Java 7)

[Impact] Attackers can exploit JNDI Lookup patterns via Thread Context Map (MDC) inputs in non-default configurations to achieve remote code execution (RCE) or information leakage

[Mitigation] Immediately upgrade Apache Log4j to version 2.16.0 (for Java 8+) or 2.12.2 (for Java 7+), which disables JNDI by default and removes message lookup support

[Affected Scope] Java applications utilizing Apache Log4j2 (log4j-core) versions 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1)

[Impact] Unauthenticated remote attackers can execute arbitrary code by forcing the application to load malicious Java classes from attacker-controlled LDAP or other JNDI-related endpoints, leading to full system compromise (CVSS 10.0 Critical)

[Mitigation] Immediately upgrade Log4j2 to the latest secure version (2.17.1 or higher; or 2.12.4 / 2.3.2 depending on Java version), or apply workarounds such as removing the JndiLookup class

[Affected Scope] Apache HTTP Server versions 2.4.49 and 2.4.50

[Impact] Unauthenticated remote attackers can exploit this vulnerability to access sensitive files outside the document root or execute arbitrary commands if CGI scripts are enabled

[Mitigation] Immediately upgrade Apache HTTP Server to version 2.4.51 or later, and enforce strict directory access controls

[Affected Scope] Apache HTTP Server version 2.4.49.

[Impact] Attackers can exploit this vulnerability using specially crafted URLs to access sensitive files outside the document root or execute arbitrary commands (RCE) if CGI scripts are enabled.

[Mitigation] Immediately upgrade to the latest stable version (2.4.51 or higher) and enforce strict directory access controls ('Require all denied').

[Affected Scope] Apache HTTP Server versions 2.4.48 and earlier with mod_proxy enabled

[Impact] Unauthenticated remote attackers can craft malicious URI paths to force mod_proxy to forward requests to an arbitrary origin server, leading to SSRF

[Mitigation] Immediately upgrade Apache HTTP Server to version 2.4.49 or later, or apply strict RewriteRules to block malicious proxy requests

[Affected Scope] Apache Struts framework versions 2.0.0 through 2.5.25

[Impact] Unauthenticated remote attackers can execute arbitrary code on the host system by exploiting forced double OGNL evaluation in tag attributes

[Mitigation] Immediately upgrade Apache Struts to version 2.5.26 or higher, and avoid evaluating raw user input inside Struts tag attributes

[Affected Scope] Apache Airflow versions prior to 1.10.11, and existing installations retaining default configurations

[Impact] Unauthenticated attackers can access the Experimental API to trigger arbitrary DAGs, leading to full remote code execution (RCE) and server compromise

[Mitigation] Upgrade Apache Airflow to version 1.10.11 or higher, or explicitly configure the API authentication backend to 'deny_all' in airflow.cfg

[Affected Scope] Apache Tomcat versions 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, and 7.0.0 to 7.0.99

[Impact] Attackers with access to the AJP port (default 8009) can read arbitrary files from the web application or execute arbitrary code (RCE) if file upload is permitted

[Mitigation] Upgrade to Apache Tomcat 9.0.31, 8.5.51, 7.0.100 or later, or disable/restrict the AJP Connector in the configuration