CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2012-6612 – Solr: XML eXternal Entity (XXE) flaw in XML and XSLT UpdateRequestHandler
https://notcve.org/view.php?id=CVE-2012-6612
07 Dec 2013 — The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407. El (1) UpdateRequestHandler para XSLT o (2) XPathEntityProcessor en Apache Solr anteriores a 4.1 permite a atacantes remotos tener un impacto no especificado a través de datos XML que c... • http://rhn.redhat.com/errata/RHSA-2013-1844.html •
CVSS: 6.4EPSS: 92%CPEs: 11EXPL: 1CVE-2013-6397 – Solr: directory traversal when loading XSL stylesheets and Velocity templates
https://notcve.org/view.php?id=CVE-2013-6397
07 Dec 2013 — Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries. Vulnerabilidad de salto de directorio en SolrResourceLoader en Apache Solr anteriores a 4.6 permite a ata... • http://lucene.apache.org/solr/4_6_0/changes/Changes.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 6%CPEs: 6EXPL: 0CVE-2013-6407 – Solr: XML eXternal Entity (XXE) flaw in XML and XSLT UpdateRequestHandler
https://notcve.org/view.php?id=CVE-2013-6407
07 Dec 2013 — The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. El UpdateRequestHandler de XML en Apache Solr anteriores a 4.1 permite a atacantes remtos tener un impacto no especificado a través de datos XML conteniendo una declaración de entidad externa en conjunción con una referencia a entidad, relacionado con un p... • http://rhn.redhat.com/errata/RHSA-2013-1844.html •
CVSS: 6.5EPSS: 6%CPEs: 10EXPL: 0CVE-2013-6408 – Solr: XML eXternal Entity (XXE) flaw in DocumentAnalysisRequestHandler
https://notcve.org/view.php?id=CVE-2013-6408
07 Dec 2013 — The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407. El DocumentAnalysisRequestHandler en Apache Solr anteriores a 4.3.1 no utiliza correctamente el EmptyEntityResolver, lo... • http://rhn.redhat.com/errata/RHSA-2013-1844.html •
CVSS: 6.1EPSS: 1%CPEs: 2EXPL: 0CVE-2009-3821
https://notcve.org/view.php?id=CVE-2009-3821
28 Oct 2009 — Cross-site scripting (XSS) vulnerability in the Apache Solr Search (solr) extension 1.0.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Apache Solr Search (solr) extension v1.0.0 para TYPO3 permite a atacantes remotos inyectar código web o HTML de su elección a través de vectores no especificados. • http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-014 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •