Drill (Apache) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 30 known versions, newest CVE from 2024-07-24. Vendor: Apache.

CVEs of Drill

• CVE-2023-48362 - CVSS 9.8 (critical), 2024-07-24: XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a…
• CVE-2019-14439 - CVSS 7.5 (high), 2019-07-30: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for…
• CVE-2019-0201 - CVSS 5.9 (medium), 2019-05-23: An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when…
• CVE-2019-10241 - CVSS 6.1 (medium), 2019-04-22: In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a…
• CVE-2017-12630 - CVSS 5.4 (medium), 2017-12-18: In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page…
• CVE-2010-5312 - CVSS 6.1 (medium), 2014-11-24: Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary…