831 matches found
Apache Solr 6.0.0 < 6.6.5 Remote Code Execution
In Apache Solr versions 5.0.0 5.5.5 and 6.0.0 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker may take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side. Note that t...
VulnCheck KEV: CVE-2019-0193
The optional Apache Solr module DataImportHandler contains a code injection vulnerability...
CVE-2019-17558
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...
Apache Solr < 8.4.0 Remote Code Execution
The version of Apache Solr running on the remote host is at least 5.0.0 and prior to 8.4.0. It is, therefore, affected by a remote code execution vulnerability. A remote code execution vulnerability exists in VelocityResponseWriter due to a flaw in the velocity template parameter. An...
Apache Solr Code Injection Vulnerability
Apache Solr is the United States Apache Apache Software Foundation of a Lucene a full-text search engine based on the search server . The product supports level search , vertical search , highlighting search results and so on. A code injection vulnerability exists in Apache Solr versions 5.0.0...
CVE-2019-17558
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...
CVE-2019-17558
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...
Remote code execution
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...
CVE-2019-17558
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...
CVE-2019-17558
CVE-2019-17558 affects Apache Solr 5.0.0–8.3.1 and allows remote code execution via the VelocityResponseWriter. An attacker can supply a Velocity template through configset velocity/ or via a parameter; enabling the resource loader for templates requires a configured response writer. Solr 8.4 rem...
CVE-2019-17558
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...
CVE-2019-17558
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...
CVE-2019-17558
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...
Solr -- multiple vulnerabilities
Community reports: 8.1.1 and 8.2.0 users check ENABLEREMOTEJMXOPTS setting Apache Solr RCE vulnerability due to bad config default Apache Solr RCE through VelocityResponseWriter...
Apache Solr CVE-2019-17558 Remote Code Execution Vulnerability
Description Apache Solr is prone to a remote-code execution vulnerability. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions. Apache Solr versions prior 5.0.0 throug...
PT-2019-5683 · Apache +1 · Apache Solr +1
Name of the Vulnerable Software and Affected Versions: Apache Solr versions 5.0.0 through 8.3.1 Description: The issue is related to insufficient input validation in the VelocityResponseWriter component of Apache Solr, allowing for remote code execution. A Velocity template can be provided throug...
The vulnerability of the solr.in.sh component of the Apache Solr search server allows attackers to upload malicious files.
The vulnerability of the solr.in.sh component of the Apache Solr search server is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to upload malicious files through the RMI PORT remotely...
CVE-2019-0193
A flaw was found in Apache Solr’s DataImportHandlerDIH. A DIH configuration containing scripts coming from a request's dataConfig parameter allows an attacker to perform remote code execution. Mitigation Edit solrconfig.xml to configure all DataImportHandler usages with an "invariants" section...
Security Bulletin: A vulnerability in Apache Solr (lucene) affects IBM Operations Analytics - Log Analysis (CVE-2019-4243)
Summary A vulnerability on unrestricted access was addressed by IBM Operations Analytics - Log Analysis. Vulnerability Details CVEID: CVE-2019-4243 DESCRIPTION: CVSS Base score: 5.1 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/159517 for the current score. CVSS...