Advisories · Technology
Apache Software Foundation Apache Pulsar.
Every CVE that names Apache Software Foundation Apache Pulsar among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.7 High
Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage
- Apache Software Foundation Apache Pulsar
- Path traversal
- CVSS 7.7 High
Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 2.3 Low
Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 8.7 High
Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 5.3 Medium
Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 4.9 Medium
Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 7.2 High
Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 2.3 Low
Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization
- Apache Software Foundation Apache Pulsar
- CWE-636
- CVSS 2.3 Low
Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 2.3 Low
Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 6.0 Medium
Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 2.3 Low
Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 5.3 Medium
Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 9.2 CriticalCritical · CVSS 9+
Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role
- Apache Software Foundation Apache Pulsar
- Weak cryptography or TLS