cve-2019-17558-apache-solr-rce

Apache Solr RCE CVE-2019-17558 - CTF 报告 在 Apache Solr 中对 Velocity 模板注入漏洞进行实际利用，从自动化工具（Metasploit）的一个缺陷演进到成功的手动利用。 本报告记录了该练习的完整推理过程，重点在于诊断工具失败的原因并转向手动利用。 场景 项目| 描述 ---|--- 目标| 运行 Apache Solr 的 Linux 服务器，端口 8983 目的| 读取敏感文件（/home/favoritebook.txt）的内容 漏洞| CVE-2019-17558（通过 Velocity Response Writer 实现...

solr_rce

Apache Solr RCE via Velocity template python usage: python solrrce.py http://x.x.x.x:8983 command getshell encode payload http://www.jackson-t.ca/runtime-exec-payloads.html whoami bash -c echo,d2hvYW1p|base64,-d|bash,-i 0x01 solr简介 Solr是Apache Lucene项目的开源企业搜索平台。...

Apache-Solr-RCE-via-Velocity-template

Apache-Solr-RCE-via-Velocity-template 参考链接 漏洞产生原因： 1. 当攻击者可以直接访问Solr控制台时，可以通过发送类似/节点名/config的POST请求对该节点的配置文件做更改。 2. Apache...

CVE-2025-5186 thinkgem JeeSite URI Scheme form ResourceLoader.getResource server-side request forgery

A vulnerability was found in thinkgem JeeSite up to 5.11.1. It has been rated as critical. Affected by this issue is the function ResourceLoader.getResource of the file /cms/fileTemplate/form of the component URI Scheme Handler. The manipulation of the argument Name leads to server-side request...

CVE-2025-5186 thinkgem JeeSite URI Scheme form ResourceLoader.getResource server-side request forgery

A vulnerability was found in thinkgem JeeSite up to 5.11.1. It has been rated as critical. Affected by this issue is the function ResourceLoader.getResource of the file /cms/fileTemplate/form of the component URI Scheme Handler. The manipulation of the argument Name leads to server-side request...

PT-2025-22928 · Thinkgem · Thinkgem Jeesite

Name of the Vulnerable Software and Affected Versions: thinkgem JeeSite versions up to 5.11.1 Description: A critical issue affects the function ResourceLoader.getResource of the file /cms/fileTemplate/form in the component URI Scheme Handler. The manipulation of the argument Name leads to...

Malicious code in @zohocalendar/resource-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware faab1535d62039670d3ec4cef9f0fb0bb279a2b5a0e788146a71e9d1770d3c6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Remote Code Execution (RCE)

solr-velocity is vulnerable to remote code execution RCE. The vulnerability can be caused by loading custom Velocity templates containing malicious code since the solr resource loader in VelocityResponseWriter.java was on by default...

Apache Solr Remote Command Execution Vulnerability Based on Velocity Templates

Apache Solr is the United States Apache Apache Software Foundation of a Lucene a full-text search engine based on the search server . The product supports level search , vertical search , highlighting search results and so on. A remote command execution vulnerability exists in Apache Solr based o...

Apache Solr Remote Code Execution via Velocity Template

This module exploits a vulnerability in Apache Solr use exploit/multi/http/solr/velocityrce msf undefinedvelocityrce show actions ...actions... msf undefinedvelocityrce set ACTION msf undefinedvelocityrce show options ...show and set options... msf undefinedvelocityrce run This module requires...

Design/Logic Flaw

Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Solr: directory traversal when loading XSL stylesheets and Velocity templates

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. dot dot or full pathname in the tr parameter to solr/select/, when the response writer wt parameter is set to XSLT. NOTE: this can be leveraged using a separa...

DEBIAN-CVE-2013-6397

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. dot dot or full pathname in the tr parameter to solr/select/, when the response writer wt parameter is set to XSLT. NOTE: this can be leveraged using a separa...

CVE-2013-2921

Double free vulnerability in the ResourceFetcher::didLoadResource function in core/fetch/ResourceFetcher.cpp in the resource loader in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering...

CVE-2013-2921

CVE-2013-2921 is a use-after-free in Blink’s resource loader (ResourceFetcher::didLoadResource), affecting Chromium/Blink prior to 30.0.1599.66. The flaw can allow remote denial of service or other unspecified impacts via resource callback handling. Public records in connected docs confirm this C...

CVE-2013-2921

Removed by vendor...

CVE-2012-1579

The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 includes private data such as CSRF tokens in a JavaScript file, which allows remote attackers to obtain sensitive information...

Cross site request forgery (csrf)

The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 includes private data such as CSRF tokens in a JavaScript file, which allows remote attackers to obtain sensitive information...

CVE-2012-1579

The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 includes private data such as CSRF tokens in a JavaScript file, which allows remote attackers to obtain sensitive information...

CVE-2012-1579

The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 includes private data such as CSRF tokens in a JavaScript file, which allows remote attackers to obtain sensitive information...