CVE-2022-41398

The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information...

CVE-2009-3821

Cross-site scripting XSS vulnerability in the Apache Solr Search solr extension 1.0.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

The vulnerability of ZIP files stored in the Apache Solr search server allows attackers to gain unauthorized access to protected information or cause service failures.

The vulnerability of ZIP files processed by the Apache Solr search server is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service failures...

Security Bulletin: Denial of Service in Apache Commons Compress used by Apache Solr affect IBM Operations Analytics - Log Analysis (CVE-2024-25710, CVE-2024-26308)

Summary There is a potential denial of service in Apache Commons Compress that is used by Apache Solr and IBM Operations Analytics - Log Analysis. This is caused by loop with unreachable exit condition and allocation of resources without limits. Vulnerability Details CVEID:CVE-2024-25710...

Security Bulletin: Vulnerabilities in Apache Solr (lucene) and Apache ZooKeeper affect IBM Operations Analytics - Log Analysis (CVE-2024-23454, CVE-2024-30171, CVE-2024-23944)

Summary There are vulnerabilities in Bouncy Castle, Apache Hadoop that potentially expose sensitive information that affect Apache Solr and Apache ZooKeeper used by IBM Operations Analytics - Log Analysis Vulnerability Details CVEID:CVE-2024-23454 DESCRIPTION: Apache Hadoop could allow a local...

Security Bulletin: Multiple vulnerabilities have been identified in Apache Solr shipped with IBM Operations Analytics - Log Analysis

Summary Multiple vulnerabilities in Apache Solr affect IBM Operations Analytics - Log Analysis. These have been addressed. Vulnerability Details CVEID:CVE-2024-45216 DESCRIPTION: Apache Solr could allow a remote attacker to bypass security restrictions, caused by improper authentication validatio...

Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046

This module provides support for creating searches using the Apache Solr search engine and the Search API Drupal module. The module doesn't sufficiently protect certain routes from CSRF attacks. This vulnerability is mitigated by the fact that a site admin would have to perform further steps afte...

Security Bulletin: Vulnerability in Apache Solr (lucene), Apache ZooKeeper and Logstash affect IBM Operations Analytics - Log Analysis (CVE-2024-9823, CVE-2024-47554)

Summary There is a potential denial of service with Apache Commons IO, Eclipse Jetty that affect Apache Solr lucene, Apache ZooKeeper and Logstash used by IBM Operations Analytics - Log Analysis Vulnerability Details CVEID:CVE-2024-9823 DESCRIPTION: There exists a security vulnerability in Jetty'...

Security Bulletin: Vulnerabilities in Apache Solr (lucene) affect IBM Operations Analytics - Log Analysis (CVE-2025-24814, CVE-2024-52012)

Summary There are vulnerabilities in privilege escalation and arbitrary filepath write-access that affect Apache Solr used by IBM Operations Analytics - Log Analysis. Vulnerability Details CVEID:CVE-2025-24814 DESCRIPTION: Core creation allows users to replace "trusted" configset files with...

Security Bulletin: Multiple vulnerabilities in Apache Solr (lucene) affects IBM Operations Analytics - Log Analysis (CVE-2023-50386, CVE-2023-50298, CVE-2023-50292, CVE-2023-50291)

Summary There are vulnerabilities in backup/restore APIs, Solr streaming expressions, and Apache Solr schema designer that affect Apache Solr used by IBM Operations Analytics - Log Analysis. Vulnerability Details CVEID:CVE-2023-50386 DESCRIPTION: Improper Control of Dynamically-Managed Code...

The vulnerability of the “FileSystemConfigSetService” component of the Apache Solr search server, which allows a hacker to load malicious code.

The vulnerability of the “FileSystemConfigSetService” component of the Apache Solr search server is related to errors in privilege management. Exploiting this vulnerability could allow a malicious actor to load malicious code remotely...

Linux Distros Unpatched Vulnerability : CVE-2017-12629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener...

USN-7283-1: Apache Solr vulnerability

It was discovered that the Apache Solr DataImportHandler module incorrectly handled certain request parameters in a default configuration. A remote attacker could possibly use this issue to execute arbitrary code...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Apache Solr vulnerability (USN-7283-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7283-1 advisory. It was discovered that the Apache Solr DataImportHandler module incorrectly handled certain request parameters in a default configuration....

Ubuntu: Security Advisory (USN-7283-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Vulnerabilities in Apache Solr affect watsonx.data

Summary Apache Solr is vulnerable to upload of arbritrary files attacks and to exposure of sensitive information attacks. This could affect watsonx.data. Vulnerability Details CVEID:CVE-2023-50386 DESCRIPTION: Apache Solr could allow a remote attacker to upload arbitrary files, caused by the...

Relative Path Traversal

org.apache.solr, solr-core is vulnerable to Relative Path Traversal. The vulnerability is due to a lack of input sanitization in the "configset upload" API, which allows the arbitrary filepath write-access when processing ZIP files...

BIT-SOLR-2024-52012 Apache Solr: Configset upload on Windows allows arbitrary path write-access

Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API. Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths t...

BIT-SOLR-2025-24814 Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files

Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that 1 use the "FileSystemConfigSetService" component the default in "standalone" or "user-managed" mode, and 2 are running without authentication and authorization are vulnerable to a sort...

CVE-2025-24814

A flaw was found in Apache Solr. Solr instances that use the "FileSystemConfigSetService" component, the default in "standalone" or "user-managed" mode, and are running without authentication and authorization are vulnerable to a privilege escalation wherein individual "trusted" config set files...