org.jenkins-ci.lib:xtrigger-lib (>=0.34, <=0.35), org.jenkins-ci.main:jenkins-test-harness (1.590) +4 more potentially affected by CVE-2023-27898 via org.jenkins-ci.main:jenkins-core (1.590)

org.jenkins-ci.main:jenkins-core MAVEN version 1.590 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.lib:xtrigger-lib =0.34, =3.0, =4.4 -...

lucene:IndexSearchFuzzer: Security exception in org.apache.lucene.util.automaton.RegExp.parseConcatExp

Project: https://github.com/apache/lucene.git Detailed Report: https://oss-fuzz.com/testcase?key=5300880686841856 Project: lucene Fuzzing Engine: libFuzzer Fuzz Target: IndexSearchFuzzer Job Type: libfuzzerasanlucene Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

lucene:IndexSearchFuzzer: Security exception in org.apache.lucene.queryparser.classic.QueryParser.Query

Detailed Report: https://oss-fuzz.com/testcase?key=5370049037991936 Project: lucene Fuzzing Engine: libFuzzer Fuzz Target: IndexSearchFuzzer Job Type: libfuzzerasanlucene Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

lucene:QueryParserFuzzer: Security exception in org.apache.lucene.util.graph.GraphTokenStreamFiniteStrings.articulationPointsRec

Detailed Report: https://oss-fuzz.com/testcase?key=4713344478347264 Project: lucene Fuzzing Engine: libFuzzer Fuzz Target: QueryParserFuzzer Job Type: libfuzzerasanlucene Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

K10631153: Apache Solr vulnerability CVE-2017-12629

Security Advisory Description Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to...

SUSE CVE-2015-4165

The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and...

Logicaldoc LogicalDOC cross-site scripting vulnerabilities

LogicalDOC is the U.S. LogicalDOC company a set of document management system developed using Java technology . The system has features such as Lucene full-text search indexing and automatic import. A security vulnerability exists in LogicalDOC Enterprise. An attacker could exploit this...

org.apache.archiva:archiva-configuration (1.1.4), org.apache.archiva:archiva-consumer-api (1.1.4) +10 more potentially affected by CVE-2022-40308 via org.apache.archiva:archiva-common (1.1.4)

org.apache.archiva:archiva-common MAVEN version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.archiva:archiva-common and may be impacted: - org.apache.archiva:archiva-configuration 1.1.4 - org.apache.archiva:archiva-consumer-api 1.1....

org.apache.archiva:archiva-configuration (1.1.3), org.apache.archiva:archiva-consumer-api (1.1.3) +10 more potentially affected by CVE-2022-40309 via org.apache.archiva:archiva-common (1.1.3)

org.apache.archiva:archiva-common MAVEN version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.archiva:archiva-common and may be impacted: - org.apache.archiva:archiva-configuration 1.1.3 - org.apache.archiva:archiva-consumer-api 1.1....

com.lightbend.akka:akka-stream-alpakka-geode_2.11 (2.0.2), com.lightbend.akka:akka-stream-alpakka-geode_2.12 (>=2.0.2, <=3.0.4) +41 more potentially affected by CVE-2022-37021 via org.apache.geode:geode-core (>=1.13.0, <=1.13.4)

org.apache.geode:geode-core MAVEN version =1.13.0, =2.0.2, =2.0.2, =1.13.0, =1.13.0, =1.13.0, =1.13.0, =1.13.0, =1.13.0, =1.13.0, =1.13.2, =1.13.2, =1.13.2, =1.13.0, =1.13.0, =1.13.4 and more Source cves: CVE-2022-37021 Source advisory: MEND:CVE-2022-37021...

Jenkins Lucene-Search Plugin Auth Bypass

The vulnerability of the Jenkins Lucene-Search Plugin is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Jenkins Lucene-Search Plugin XSS

The vulnerability of the Jenkins Lucene-Search Plugin exists due to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

GHSA-6954-H5C8-M29F Jenkins Lucene-Search Plugin vulnerable to reflected (XSS) cross-site scripting

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the search result page. This results in a reflected cross-site scripting XSS vulnerability...

Lucene-Search Plugin does not perform permission checks in several HTTP endpoints

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them...

Jenkins Lucene-Search Plugin vulnerable to reflected (XSS) cross-site scripting

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the search result page. This results in a reflected cross-site scripting XSS vulnerability...

GHSA-M8W5-VWQ3-GP8F Lucene-Search Plugin does not perform permission checks in several HTTP endpoints

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them...

CVE-2022-36922

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2022-36922

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2022-36922

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2022-36910

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them...