Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Solr

Summary Muiltiple vulnerabilities in Apache Solr that is used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID: CVE-2021-27905 DESCRIPTION: Apache Solr is vulnerable to server-side request forgery, caused by improper validation of the masterUrl parameter in the...

VulnCheck KEV: CVE-2019-17558

The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution...

Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability

The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution...

Security Bulletin: Apache Solr, shipped with IBM Operations Analytics - Log Analysis, susceptible to multiple vulnerabilities in Apache Tika

Summary There are vulnerabilities in various versions of Apache Tika that affect Apache Solr. The vulnerabilities are in Vulnerability Details section. Vulnerability Details CVEID: CVE-2019-10094 DESCRIPTION: Apache Tika is vulnerable to a stack-based buffer overflow, caused by a flaw in the...

[SECURITY] Fedora 34 Update: dovecot-fts-xapian-1.4.13-1.fc34

This project intends to provide a straightforward, simple and maintenance free, way to configure FTS plugin for Dovecot, leveraging the efforts by the Xapian.org team. This effort came after Dovecot team decided to deprecate "ftssquat" included in the dovecot core, and due to the complexity of th...

Log Analysis Security Bulletin List

Question Is there a list of security bulletins that describe resolved vulnerabilities affecting Log Analysis? Answer Log Analysis is made up of several components. The following table contains security bulletins that address the vulnerability of various components in Log Analysis, listed by...

Exploit for Improper Restriction of XML External Entity Reference in Apache Solr

注意: 切勿利用本工具对未授权的网站进行非法攻击。由此产生的法律后果由使用者自行承担!!! 软件更新早知道 下一版本将补weblogic漏洞将新增spring data Spring Cloud 漏洞敬请期待!!!! AttackWebFrameworkTools 1.0 2021-03-06 AttackWebFrameworkTools For RedTeam 更新状态日志: 2021-03-28 新增 CNVD-2021-10543 MessageSolution信息泄露漏洞,新增Apache OFBiz...

Exploit for Server-Side Request Forgery in Apache Solr

CVE-2021-27905 Apache Solr ReplicationHandler Server Side Requ...

Security Bulletin: Potential vulnerability (SSRF) in Apache Solr affect IBM Operations Analytics - Log Analysis (CVE-2017-3164)

Summary Server Side Request Forgery vulnerability in Apache Solr could allow attacker with access to make Solr perform a HTTP to any reachable URL. Vulnerability Details CVEID: CVE-2017-3164 DESCRIPTION: Apache Solr is vulnerable to server-side request forgery, caused by not having corresponding...

Logic Flaw Vulnerability in Apache Solr

Apache Solr is an open source search service , using the Java language development , mainly based on HTTP and Apache Lucene implementation . Apache Solr has a logic flaw vulnerability that can be exploited by attackers to obtain sensitive information and perform unauthorized operations...

Unauthorized Access Vulnerability in Apache Solr

Apache Solr is an open source search service , using the Java language development , mainly based on HTTP and Apache Lucene implementation . An unauthorized access vulnerability exists in Apache Solr, which can be exploited by attackers to obtain sensitive information...

Apache Solr SSRF漏洞 (CVE-2021-27905)

...

Solr-GRAB - Steal Apache Solr Instance Queries With Or Without A Username And Password

Steal Apache Solr instance Queries with or without a username and password. DISCLAIMER : This project should be used for authorized testing and educational purposes only. Download git clone https://github.com/GnosticPlayers/Solr-GRAB Usage You can search for Apache Solr Instances via Censys, with...

Insecure Access Control

solr-core is vulnerable to Insecure Access Control. A node that is configured with the optional read-only user, and with SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, would not be treated as a sensitive path and would allow it to be readable...

Improper permission handling in Apache Solr

When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be...

GHSA-JGCR-FG3G-QVW8 Improper permission handling in Apache Solr

When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be...

GHSA-5PHW-3JRP-3VJ8 Server-Side Request Forgery in Apache Solr

The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability,...

Server-Side Request Forgery in Apache Solr

The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability,...

Incorrect Authorization in Apache Solr

When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts...

GHSA-VF7P-J8X6-XVWP Incorrect Authorization in Apache Solr

When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts...