Known vulnerabilities in Karaf

Software: Karaf
Software CPE: cpe:2.3:a:apache_foundation:karaf:*:*:*:*:*:*:*:*
Total vulnerabilities: 12
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Karaf Karaf is affected by 12 known vulnerabilities: 3 high, 5 medium, 4 low Critical High Medium Low

Vulnerabilities (12)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU70477 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-40145
CWE-94 Medium
No
No
4.3.8, 4.4.2 22.12.2022 SB2022122212
#VU60080 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-22932
CWE-22 Medium
No
No
4.2.15, 4.3.6 27.01.2022 SB2022012709
#VU59995 - Deserialization of Untrusted Data
CVE-2021-41766
CWE-502 Medium
No
No
4.3.6 25.01.2022 SB2022012521
#VU59098 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-44832
CWE-94 Medium
No
No
4.2.15, 4.3.6 28.12.2021 SB2021122816
SB2021123002
SB2022010601
and 197 more
#VU30259 - Server-Side Request Forgery (SSRF)
CVE-2020-11980
CWE-918 High
No
No
4.2.9 13.06.2020 SB2020061307
#VU18431 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2019-0226
CWE-22 Low
No
No
4.2.5 11.05.2019 SB2019051101
#VU31146 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2019-0191
CWE-22 Medium
No
No
4.2.3 21.03.2019 SB2019032123
#VU16895 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2018-11788
CWE-611 Low
No
No
4.1.7, 4.2.2 09.01.2019 SB2019010908
#VU36684 - Improper Privilege Management
CVE-2018-11786
CWE-269 High
No
No
4.2.0 18.09.2018 SB2018091817
#VU31204 - Improper Authentication
CVE-2018-11787
CWE-287 High
No
No
4.1.1 18.09.2018 SB2018091808
#VU11135 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CVE-2016-8750
CWE-90 Low
No
No
- 16.03.2018 SB2016101801
SB2018050312
#VU31398 - Improper input validation
CVE-2014-0219
CWE-20 Low
No
No
4.0.10 15.11.2017 SB2017111518