CVE-2025-46727: Uncontrolled Resource Consumption

Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, Rack::QueryParser parses query strings and application/x-www-form-urlencoded bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with...

Cross-site Scripting (XSS)

xapian-core is vulnerable to Cross-site Scripting XSS. The vulnerability is caused due to improper handling of HTML escaping by Xapian::MSet::snippet in queryparser/termgeneratorinternal.cc. This allows an attacker to potentially execute arbitrary scripts in the context of a user's web browser wh...

lucene:QueryParserFuzzer: Security exception in org.apache.lucene.analysis.hi.HindiNormalizer.normalize

Detailed Report: https://oss-fuzz.com/testcase?key=5205968013033472 Project: lucene Fuzzing Engine: libFuzzer Fuzz Target: QueryParserFuzzer Job Type: libfuzzerasanlucene Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

lucene:QueryParserFuzzer: Security exception in org.apache.lucene.util.BytesRefBuilder.<init>

Project: https://github.com/apache/lucene.git Detailed Report: https://oss-fuzz.com/testcase?key=4689417899737088 Project: lucene Fuzzing Engine: libFuzzer Fuzz Target: QueryParserFuzzer Job Type: libfuzzerasanlucene Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

lucene:IndexSearchFuzzer: Security exception in org.apache.lucene.queryparser.classic.QueryParser.Query

Detailed Report: https://oss-fuzz.com/testcase?key=5370049037991936 Project: lucene Fuzzing Engine: libFuzzer Fuzz Target: IndexSearchFuzzer Job Type: libfuzzerasanlucene Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

GHSA-7QW4-W7HF-22Q3 xapian-core Cross-site Scripting vulnerability

A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet...

xapian-core Cross-site Scripting vulnerability

A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet...

Remote Code Execution (RCE)

lucene-queryparser is vulnerable to remote code execution. This is possible through the use of an XML external entity expansion XXE attack and the Config API with add-listener command...

CVE-2018-0499

CVE-2018-0499 affects the Xapian project’s core library (xapian-core) before version 1.4.6. The root cause is incomplete HTML escaping in the code path for snippets, specifically in queryparser/termgenerator_internal.cc via Xapian::MSet::snippet(), which enables cross-site scripting. Documented i...

CVE-2018-0499

A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet...

CVE-2018-0499: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet...

Remote Code Execution (RCE)

lucene-queryparser is vulnerable to remote code execution RCE. This is possible through the use of an XML external entity expansion XXE attack and the Config API with add-listener command...