GHSA-H7W9-C5VX-X7J3 Insecure Default Initialization of Resource vulnerability in Apache Solr

New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to "trusted"...

CVE-2024-45217

Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted...

CVE-2024-45217 Apache Solr: ConfigSets created during a backup restore command are trusted implicitly

Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted...

CVE-2024-45217 Apache Solr: ConfigSets created during a backup restore command are trusted implicitly

Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted...

CVE-2024-45217

Apache Solr is vulnerable to an Insecure Default Initialization of Resource (CWE-1188) flaw. When new ConfigSets are created using a Restore command to copy a configSet from a backup with a new name, they are initialized without the "trusted" metadata. Because ConfigSets lacking this flag are imp...

CVE-2024-45217

Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted...

mm: vmalloc: ensure vmap_block is initialised before adding to queue

...

Apache Solr security vulnerabilities

Apache Solr is the United States Apache Apache Foundation of a search server based on Lucene a full-text search engine. The product supports level search , vertical search , highlighting search results and so on. A code issue vulnerability exists in Apache Solr, which stems from the presence of a...

ROS-20241016-01

Vulnerability of nvmet-tcp component of Linux kernel is related to dereferencing of NULL pointer in the nvmettcpinstallqueue function in drivers/nvme/target/tcp.c. Exploitation of the vulnerability could allow an attacker to cause a denial of service Vulnerability in iwldeallocucode function in...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the mmioread function in the Linux operating system’s kernel is related to a memory leak that occurs due to incorrect initialization of the variable val. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the mmioread function in the Linux operating system’s kernel is related to a memory leak that occurs due to incorrect initialization of the variable val. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux seqpacket_allow() Data Compromise

The vulnerability of the seqpacketallow function in the Linux operating system’s kernel is related to improper initialization. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2024-47945 Predictable Session ID

The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid session IDs, leading to unauthorized access to user sessions...

soc: qcom: pmic_glink: Fix race during initialization

...

kernel: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()

A vulnerability was found in the Linux kernel's ext4 filesystem within the ext4fillsuper function, where uninitialized access to ratelimitstate-lock can occur, where the sysfs interface is registered before properly initializing rs-lock, potentially allowing other processes to modify rs-interval ...

PT-2024-33978

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, specifically in the net/mlx5e module. The issue occurs when profile rollback fails in mlx5e netdev change profile, causing the...

PT-2024-34041

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: A memory corruption issue has been identified in the Linux kernel's Ethernet driver initialization, specifically in the mtk eth soc component. The problem occurs during the FQ DMA...

PT-2024-31485 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions 6.6.0 through 8.11.3 Apache Solr versions 9.0.0 through 9.6.x Description: The issue arises from the insecure default initialization of resources in Apache Solr, where new ConfigSets created via a Restore command lack the...

PT-2024-36895

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability has been resolved in the Linux kernel related to the scsi: hisi sas driver. The issue occurs when the dump is triggered while the driver is unbind, causing a hang due to ...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2024-12782)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12782 advisory. - VMCI: Fix use-after-free when removing resource in vmciresourceremove David Fernandez Gonzalez Orabug: 37037205 CVE-2024-46738 - exec: Fix ToCTo...