CVE-2021-28163

CVE-2021-28163 (Jetty symlink handling) is reported across multiple IBM advisories as a vulnerability in Eclipse Jetty where if the ${jetty.base} or ${jetty.base}/webapps directory is a symlink, an attacker could obtain the contents of the webapps directory. IBM documents list affected products s...

CVE-2013-6397

Apache Solr (SolrResourceLoader) is vulnerable to a directory traversal via the tr parameter in solr/select/ when wt is XSLT, allowing reading of arbitrary files. Affected versions are Solr up to 4.5.x (before 4.6.0); the issue is caused by insufficient path validation and can be combined with an...

CVE-2018-11802

CVE-2018-11802 involves Apache Solr authorization bypass: if a node receives a request for a collection it does not host, it proxies the request to a node that does host it, bypassing all authorization settings. This affects Solr versions prior to 7.7 that use the default RuleBasedAuthorizationPl...

CVE-2014-3628

CVE-2014-3628 affects Apache Solr 4.x prior to 4.10.3, specifically the Admin UI Plugin / Stats page. The vulnerability is an XSS due to improper sanitization of data in the fieldvaluecache object, allowing a remote attacker to inject arbitrary script/HTML into a victim’s browser. The issue is do...

CVE-2009-3821

CVE-2009-3821 is an XSS vulnerability affecting the TYPO3 Apache Solr extension (solr) version 1.0.0. Multiple connected sources confirm an Eiffel of cross-site scripting that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The root cause details are not el...