Json response for search reveals Solr credentials

Impact An error in Ibexa's Solr search engine results in potential exposure of Solr credentials. This is a critical vulnerability and all supported versions of the engine are affected. Those not using the Solr search engine are not affected. Patches The issue is fixed in all supported versions of...

GHSA-V6XP-CCVX-W52M Json response for search reveals Solr credentials

Impact An error in Ibexa's Solr search engine results in potential exposure of Solr credentials. This is a critical vulnerability and all supported versions of the engine are affected. Those not using the Solr search engine are not affected. Patches The issue is fixed in all supported versions of...

Json response for search reveals Solr credentials

Impact An error in Ibexa's Solr search engine results in potential exposure of Solr credentials. This is a critical vulnerability and all supported versions of the engine are affected. Those not using the Solr search engine are not affected. Patches The issue is fixed in all supported versions of...

Download route allows filename change in eZpublish kernel

Impact The route used for file downloads allows specifying the name of the downloaded file. This is an unintended side effect of the implementation, and means one could construct download URLs with filenames that have no relation to the actual file, which could lead to misunderstandings and...

PT-2023-32990 · Ibexa · Ibexa Solr Search Engine

Name of the Vulnerable Software and Affected Versions: Ibexa Solr search engine versions affected versions not specified Description: The issue is related to an error in Ibexa's Solr search engine, potentially exposing Solr credentials. This is a critical issue affecting all supported versions of...

PT-2023-33063 · Ibexa +1 · Ibexa +1

Name of the Vulnerable Software and Affected Versions: Ibexa/solr versions affected versions not specified Description: The issue is related to an error in Ibexa's Solr search engine, potentially exposing Solr credentials. This is a critical issue affecting all supported versions of the engine th...

PT-2023-9238 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 7.2-rc-1 through 4.10.19 XWiki Platform versions 15.5.3 and earlier XWiki Platform versions prior to 15.10-rc-1 Description: The issue is related to the execution of arbitrary code in the XWiki Platform due to improper...

Apache Solr < 8.6.0 Information Disclosure (CVE-2020-13941)

The version of Apache Solr running on the remote host is prior to 8.6.0. It is, therefore, affected by an information disclosure vulnerability. The Replication handler allows commands backup, restore and deleteBackup. Each of these take a location parameter, which was not validated, i.e you could...

Apache Solr 7.x < 7.7.4 / 8.x < 8.8.2 Multiple Vulnerabilities

The version of Apache Solr running on the remote host is 7.x prior to 7.7.4, or 8.x prior to 8.8.2. It is, therefore, affected by multiple vulnerabilities, including the following: - The ReplicationHandler normally registered at '/replication' under a Solr core has a 'masterUrl' also 'leaderUrl'...

Apache Solr 6.6.x < 6.6.7 / 7.x < 7.7.4 / 8.x < 8.6.3 Authentication Bypass (CVE-2020-13957)

The version of Apache Solr running on the remote host is 6.6.x prior to 6.6.7, or 7.x prior to 7.7.4, or 8.x prior to 8.6.3. It is, therefore, affected by an authentication bypass vulnerability. Apache Solr prevents some features considered dangerous which could be used for remote code execution ...

Security Bulletin: Denial of Service Vulnerability in Apache Solr used by IBM Operations Analytics - Log Analysis

Summary There is a potential denial of service in Apache Solr that is used by IBM Operations Analytics - Log Analysis Vulnerability Details IBM X-Force ID: 216835 DESCRIPTION: Apache Lucene is vulnerable to a denial of service. By sending a specific regular expression query, a remote attacker cou...

Apache Solr Command Execution Vulnerability

Apache Solr is an open source search service , using the Java language development , mainly based on HTTP and Apache Lucene implementation . Apache Solr suffers from a command execution vulnerability that can be exploited by an attacker to execute arbitrary code on the target system...

CVE-2022-41398

The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information...

CVE-2022-41398

The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information...

Hardcoded credentials

The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information...

CVE-2022-41398

The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information...

PT-2023-13978 · Apache +1 · Apache Solr +1

Name of the Vulnerable Software and Affected Versions: Sage 300 versions through 2022 Description: The optional Global Search feature for Sage 300 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with...

CVE-2022-41398

The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information...

Sage Group Sage 300 信任管理问题漏洞

Sage Group Sage 300 is a well-established closed-source Enterprise Resource Planning ERP solution from Sage Group, UK, designed to facilitate the management of an organization. A security vulnerability exists in Sage Group Sage 300 version 2022 and prior versions, which stems from the use of a se...

CVE-2022-41398

CVE-2022-41398 affects Sage 300 (through 2022) where the optional Global Search feature configures Apache Solr with hard-coded admin credentials. This enables login to the Solr dashboard with admin privileges and potential exposure of sensitive data. The Red Hat/Red flags and other records corrob...