Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2017-12617 — Apache Tomcat Remote Code Execution Vulnerability
When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
|
Apache | Tomcat | Mar 25, 2022 | Apr 15, 2022 | |
|
CVE-2020-1956 — Apache Kylin OS Command Injection Vulnerability
Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.
|
Apache | Kylin | Mar 25, 2022 | Apr 15, 2022 | |
|
CVE-2020-1938 — Apache Tomcat Improper Privilege Management Vulnerability
Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.
|
Apache | Tomcat | Mar 3, 2022 | Mar 17, 2022 | |
|
CVE-2016-3088 — Apache ActiveMQ Improper Input Validation Vulnerability
The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
|
Apache | ActiveMQ | Feb 10, 2022 | Aug 10, 2022 | |
|
CVE-2017-9791 — Apache Struts 1 Improper Input Validation Vulnerability
The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
|
Apache | Struts 1 | Feb 10, 2022 | Aug 10, 2022 | |
|
CVE-2006-1547 — Apache Struts 1 ActionForm Denial-of-Service Vulnerability
ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
|
Apache | Struts 1 | Jan 21, 2022 | Jul 21, 2022 | |
|
CVE-2012-0391 — Apache Struts 2 Improper Input Validation Vulnerability
The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.
|
Apache | Struts 2 | Jan 21, 2022 | Jul 21, 2022 | |
|
CVE-2020-11978 — Apache Airflow Command Injection
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
|
Apache | Airflow | Jan 18, 2022 | Jul 18, 2022 | |
|
CVE-2020-13927 — Apache Airflow's Experimental API Authentication Bypass
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
|
Apache | Airflow's Experimental API | Jan 18, 2022 | Jul 18, 2022 | |
|
CVE-2019-0193 — Apache Solr DataImportHandler Code Injection Vulnerability
The optional Apache Solr module DataImportHandler contains a code injection vulnerability.
|
Apache | Solr | Dec 10, 2021 | Jun 10, 2022 |
When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Tomcat · Mar 25, 2022
Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.
Kylin · Mar 25, 2022
Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.
Tomcat · Mar 3, 2022
The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
ActiveMQ · Feb 10, 2022
The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Struts 1 · Feb 10, 2022
ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
Struts 1 · Jan 21, 2022
The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.
Struts 2 · Jan 21, 2022
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
Airflow · Jan 18, 2022
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
Airflow's Experimental API · Jan 18, 2022
The optional Apache Solr module DataImportHandler contains a code injection vulnerability.
Solr · Dec 10, 2021