The Apache Software Foundation

Apache Directory LDAP API: Denial of service via crafted telephone number values

Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning

Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements

Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

Apache log4net: NUL character truncates OutputDebugStringAppender records

Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content

Apache log4net: Oversize EventLogAppender record silently discarded

Apache log4net: Request validation failure drops the event in the aspnet-request converter

Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch