CVE-2024-27140

>= 2.0.0

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilit

5.4MEDIUM

CVE-2024-27139

>= 2.0.0

UNSUPPORTED WHEN ASSIGNED Incorrect Authorization vulnerability in Apache Archiva: a vulnerability in Apache Archiva allows

7.5HIGH

CVE-2024-27138

>= 2.0.0

UNSUPPORTED WHEN ASSIGNED Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable

7.5HIGH

CVE-2023-28158

>= 2.0 and < 2.2.10

Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by

6.5MEDIUM

CVE-2022-40309

< 2.2.9

Users with write permissions to a repository can delete arbitrary directories.

4.3MEDIUM

CVE-2022-40308

< 2.2.9

If anonymous read enabled, it's possible to read the database file directly without logging in.

7.5HIGH

CVE-2022-29405

< 2.2.8

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8

6.5MEDIUM

CVE-2020-9495

< 2.2.5

Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from

5.3MEDIUM

CVE-2019-0214

>= 1.2 and <= 1.3.9

In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact

6.5MEDIUM

CVE-2019-0213

< 2.2.4

In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo U

6.5MEDIUM

CVE-2017-5657

<= 2.2.1

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious

8.0HIGH

CVE-2016-5005

<= 1.3.9

Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject

4.8MEDIUM

CVE-2016-4469

<= 1.3.9

Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack th

8.8HIGH

CVE-2013-2187

all versions

Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to injec

CVE-2013-2251

>= 1.3 and < 1.3.8

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1

9.8CRITICAL

CVE-2011-1077

all versions

Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote atta

CVE-2011-1026

all versions

Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remo

CVE-2011-0533

all versions

Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through

CVE-2010-4408

all versions

Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the admini

CVE-2010-3449

all versions

Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through