306 matches found
Critical: Red Hat Security Advisory: EAP Continuous Delivery Technical Preview Release 12 security update
This is a security update for JBoss EAP Continuous Delivery 12.0. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
lucene.472066.n3.nabble.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1181358 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Ubuntu: Security Advisory (USN-4259-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-4259-1: Apache Solr vulnerability
Michael Stepankin and Olga Barinova discovered that Apache Solr was vulnerable to an XXE attack. An attacker could use this vulnerability to remotely execute code...
Apache Solr < 7.1.0 Remote Code Execution
Remote code execution occurs in Apache Solr versions 7.1.0 with Apache Lucene 7.1.0 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. This can be exploited to upload malicious data to the /upload request handler or as Blind XX...
The vulnerability of the implementation of the RunExecutableListener class in the Apache Solr search server and the Apache Lucene library for full-text searching allows a perpetrator to execute arbitrary code.
The vulnerability in the implementation of the RunExecutableListener class of the Apache Solr search server and the Apache Lucene library for full-text searching is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability allows a malicious actor to...
Debian: Security Advisory (DLA-1954-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DLA-1954-1 : lucene-solr security update
A security vulnerability was discovered in lucene-solr, an enterprise search server. The DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's 'dataConfig' parameter. The deb...
CVE-2017-12629
It was found that Apache Lucene would accept an object from an unauthenticated user that could be manipulated through subsequent post requests. An attacker could use this flaw to assemble an object that could permit execution of arbitrary code if the server enabled Apache Solr's Config API...
[SECURITY] [DLA 1954-1] lucene-solr security update
Package : lucene-solr Version : 3.6.2+dfsg-5+deb8u3 CVE ID : CVE-2019-0193 A security vulnerability was discovered in lucene-solr, an enterprise search server. The DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole...
DLA-1954-1 lucene-solr - security update
Bulletin has no description...
openSUSE Security Update : java-11-openjdk (openSUSE-2019-818)
This update for java-11-openjdk fixes the following issues : Update to upstream tag jdk-11.0.1+13 Oracle October 2018 CPU Security fixes : - S8202936, CVE-2018-3183, bsc1112148: Improve script engine support - S8199226, CVE-2018-3169, bsc1112146: Improve field accesses - S8199177, CVE-2018-3149,...
Remote Code Execution (RCE)
lucene-queryparser is vulnerable to remote code execution. This is possible through the use of an XML external entity expansion XXE attack and the Config API with add-listener command...
Remote code execution occurs in Apache Solr
Remote code execution occurs in Apache Solr before versions 5.5.5, 6.6.2 and 7.1.0 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...
loreal.cz XSS vulnerability
Open Bug Bounty ID: OBB-676416 Description| Value ---|--- Affected Website:| loreal.cz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
loreal.sg XSS vulnerability
Open Bug Bounty ID: OBB-676411 Description| Value ---|--- Affected Website:| loreal.sg Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
loreal.ro XSS vulnerability
Open Bug Bounty ID: OBB-676410 Description| Value ---|--- Affected Website:| loreal.ro Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Debian DSA-4194-1 : lucene-solr - security update
An XML external entity expansion vulnerability was discovered in the DataImportHandler of Solr, a search server based on Lucene, which could result in information disclosure. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Securit...
[SECURITY] [DSA 4194-1] lucene-solr security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4194-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 06, 2018 https://www.debian.org/security/faq -...