KA
Product
Karaf
18
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 4High 7Medium 7Low 0
Watch
Add Karaf to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-0191 | 6.5 | Mar 20 | Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file Affected: before 4.2.3 |
| CVE-2016-8750 | 6.5 | Feb 19 | Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP Affected: before 4.0.8 |
| CVE-2026-91085 | 6.3 | Sep 29 | Apache Karaf: config:install missing ACL entry allows privilege escalation to admin Affected: before 4.4.12 |
| CVE-2020-11980 | 6.3 | Jun 12 | In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files Affected: before 4.2.9 |
| CVE-2014-0219 | 5.5 | Nov 15 | Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdown) by sending a shutdown command to all… Affected: before 4.0.10 |
| CVE-2022-22932 | 5.3 | Jan 26 | Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder Affected: before 4.2.15; 4.3.0 before 4.3.6 |
| CVE-2019-0226 | 4.9 | May 9 | Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite existing file Affected: before 4.2.5 |
Showing 7