Advisories · Technology
Apache Software Foundation Apache Answer.
Every CVE that names Apache Software Foundation Apache Answer among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Answer: Reaction API authorization bypass for restricted content
- Apache Software Foundation Apache Answer
- Authentication bypass
- CVSS 5.4 Medium
Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
- Apache Software Foundation Apache Answer
- Authentication bypass
- CVSS 8.1 High
Apache Answer: Missing Authorization Allows Mutations of Non-Public Content
- Apache Software Foundation Apache Answer
- CWE-202
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
- Apache Software Foundation Apache Answer
- Authentication bypass
- CVSS 4.3 Medium
Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata
- Apache Software Foundation Apache Answer
- CWE-202
- CVSS 5.3 Medium
Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles
- Apache Software Foundation Apache Answer
- CWE-202
- CVSS 7.5 High
Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
- Apache Software Foundation Apache Answer
- Information disclosure
- CVSS 4.3 Medium
Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions
- Apache Software Foundation Apache Answer
- Broken access control
- CVSS 5.3 Medium
Apache Answer: Improper Authorization in Question Invite User Lookup
- Apache Software Foundation Apache Answer
- Broken access control
- CVSS 5.4 Medium
Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
- Apache Software Foundation Apache Answer
- Broken access control
- CVSS 7.5 High
Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
- Apache Software Foundation Apache Answer
- Broken access control
- CVSS 5.4 Medium
Apache Answer: Stored XSS via unsanitized HTML in imported question content
- Apache Software Foundation Apache Answer
- Cross-site scripting (XSS)
- CVSS 8.1 High
Apache Answer: API keys logged in plaintext during authentication
- Apache Software Foundation Apache Answer
- Information disclosure
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Answer: Residual Administrative API Key Access After Role or Account Revocation
- Apache Software Foundation Apache Answer
- Authentication bypass
- CVSS 7.5 High
Apache Answer: Unauthorized disclosure of deleted or pending answer content
- Apache Software Foundation Apache Answer
- Information disclosure
- CVSS 6.5 Medium
Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions
- Apache Software Foundation Apache Answer
- Broken access control
- CVSS 6.5 Medium
Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL
- Apache Software Foundation Apache Answer
- Broken access control
- CVSS 7.5 High
Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow
- Apache Software Foundation Apache Answer
- Authentication bypass
- CVSS 7.5 High
Apache Answer: Denial of service via crafted Accept-Language header parsing
- Apache Software Foundation Apache Answer
- Denial of service