deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-6912
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2, when Internet Explorer 6 through 9 is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-6913
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in a search component in Cybozu Garoon before 3.7.2, when Internet Explorer is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-6914
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-6915
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in the system-administration component in Cybozu Garoon before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-6916
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in the Yahoo! User Interface Library in Cybozu Garoon before 3.7.2, when Internet Explorer 9 or 10 or Chrome is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cs.cybozu.co.jp/information/20131202up01.php; http://jvn.jp/en/jp/JVN23981867/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000113
CVE: CVE-2013-3921
Published: 2013-12-05
Description: Directory traversal vulnerability in Easytime Studio Easy File Manager 1.1 for iOS allows remote attackers to read arbitrary files via a ..%2f (encoded dot dot slash) to the default URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/89169; https://www.trustwave.com/spiderlabs/advisories/TWSL2013-033.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/89169
CVE: CVE-2013-5108
Published: 2013-12-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in the xn function in RockMongo 1.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) db parameter on the login page or (2) username parameter in a login.index action to index.php and other unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/55756; https://exchange.xforce.ibmcloud.com/vulnerabilities/89366; https://www.trustwave.com/spiderlabs/advisories/TWSL2013-026.txt
CVE: CVE-2013-6267
Published: 2013-12-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.11.9 allow remote attackers to inject arbitrary web script or HTML via the (1) box parameter to messaging/messagebox.php, cidToEdit parameter to (2) adminregisteruser.php or (3) admin_user_course_settings.php in admin/, (4) module_id parameter to admin/module/module.php, or (5) offset parameter to admin/right/profile_list.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0139.html; http://forum.claroline.net/viewtopic.php?f=88&t=26413; http://packetstormsecurity.com/files/124200
CVE: CVE-2013-6341
Published: 2013-12-05
Description: SQL injection vulnerability in Dokeos 2.2 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the language parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0140.html; http://packetstormsecurity.com/files/124201; http://www.exploit-db.com/exploits/30013
CVE: CVE-2013-6395
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in header.php in Ganglia Web 3.5.8 and 3.5.10 allows remote attackers to inject arbitrary web script or HTML via the host_regex parameter to the default URI, which is processed by get_context.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=730507; http://osvdb.org/100380; http://seclists.org/oss-sec/2013/q4/346
CVE: CVE-2013-6787
Published: 2013-12-05
Description: SQL injection vulnerability in the check_user_password function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the non-encrypted passwords mode set at installation, allows remote authenticated users to execute arbitrary SQL commands via the "password0" parameter.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0141.html; http://www.exploit-db.com/exploits/30012; https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-10-2013-11-06-Moderate-risk-SQL-Injection-in-specific-unrecommended-case
CVE: CVE-2013-6804
Published: 2013-12-05
Description: Cross-site scripting (XSS) vulnerability in the Search module before 1.1.1 for Jamroom allows remote attackers to inject arbitrary web script or HTML via the search_string parameter to search/results/all/1/4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/55886; https://www.htbridge.com/advisory/HTB23184; https://www.jamroom.net/the-jamroom-network/networkmarket/43/search/expanded_changelog=1
CVE: CVE-2013-1090
Published: 2013-12-06
Description: The SUSE horde5 package before 5.0.2-2.4.1 sets incorrect ownership for certain configuration files and directories including /etc/apache2/vhosts.d, which allows local wwwrun users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00025.html; https://bugzilla.novell.com/show_bug.cgi?id=811369; http://lists.opensuse.org/opensuse-updates/2013-12/msg00025.html
CVE: CVE-2013-2133
Published: 2013-12-06
Description: The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2013-1784.html; http://rhn.redhat.com/errata/RHSA-2013-1785.html; http://rhn.redhat.com/errata/RHSA-2013-1786.html
CVE: CVE-2013-4491
Published: 2013-12-07
Description: Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
CVE: CVE-2013-4492
Published: 2013-12-07
Description: Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00093.html; http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/; http://www.debian.org/security/2013/dsa-2830
CVE: CVE-2013-6414
Published: 2013-12-07
Description: actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
CVE: CVE-2013-6415
Published: 2013-12-07
Description: Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00080.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
CVE: CVE-2013-6416
Published: 2013-12-07
Description: Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/; http://www.securityfocus.com/bid/64071; https://groups.google.com/forum/message/raw?msg=ruby-security-ann/5ZI1-H5OoIM/ZNq4FoR2GnIJ
CVE: CVE-2013-6417
Published: 2013-12-07
Description: actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
CVE: CVE-2013-6634
Published: 2013-12-07
Description: The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/one_click_signin_helper.cc in Google Chrome before 31.0.1650.63 uses an incorrect URL during realm validation, which allows remote attackers to conduct session fixation attacks and hijack web sessions by triggering improper sync after a 302 (aka Found) HTTP status code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://googlechromereleases.blogspot.com/2013/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00090.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00096.html
CVE: CVE-2013-6635
Published: 2013-12-07
Description: Use-after-free vulnerability in the editing implementation in Blink, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via JavaScript code that triggers removal of a node during processing of the DOM tree, related to CompositeEditCommand.cpp and ReplaceSelectionCommand.cpp.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00090.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00096.html
CVE: CVE-2013-6636
Published: 2013-12-07
Description: The FrameLoader::notifyIfInitialDocumentAccessed function in core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 31.0.1650.63, makes an incorrect check for an empty document during presentation of a modal dialog, which allows remote attackers to spoof the address bar via vectors involving the document.write method.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://googlechromereleases.blogspot.com/2013/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00090.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00096.html
CVE: CVE-2013-6637
Published: 2013-12-07
Description: Multiple unspecified vulnerabilities in Google Chrome before 31.0.1650.63 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2013/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00090.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00096.html
CVE: CVE-2013-6638
Published: 2013-12-07
Description: Multiple buffer overflows in runtime.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a large typed array, related to the (1) Runtime_TypedArrayInitialize and (2) Runtime_TypedArrayInitializeFromArrayLike functions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/v8/source/detail?r=17800; http://googlechromereleases.blogspot.com/2013/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00090.html
CVE: CVE-2013-6639
Published: 2013-12-07
Description: The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via JavaScript code that sets the value of an array element with a crafted index.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/v8/source/detail?r=17801; http://googlechromereleases.blogspot.com/2013/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00090.html
CVE: CVE-2013-6640
Published: 2013-12-07
Description: The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds read) via JavaScript code that sets a variable to the value of an array element with a crafted index.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/v8/source/detail?r=17801; http://googlechromereleases.blogspot.com/2013/12/stable-channel-update.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00090.html
CVE: CVE-2013-6920
Published: 2013-12-07
Description: Siemens SINAMICS S/G controllers with firmware before 4.6.11 do not require authentication for FTP and TELNET sessions, which allows remote attackers to bypass intended access restrictions via TCP traffic to port (1) 21 or (2) 23.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-338-01; http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-742938.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-742938.pdf
CVE: CVE-2013-6999
Published: 2013-12-07
Description: The IsHandleEntrySecure function in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 SP2 does not properly validate the tagPROCESSINFO pW32Job field, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted NtUserValidateHandleSecure call for an owned object.  NOTE: the vendor reportedly disputes the significance of this report, stating that "it appears to be a local DOS ... we don't consider it a security vulnerability.
CVSS Score: 4.0 (MEDIUM)
References: http://pastebin.com/raw.php?i=we0ZSQC0; http://secunia.com/advisories/55633; http://www.securityfocus.com/bid/64057
CVE: CVE-2013-5455
Published: 2013-12-07
Description: IBM SmartCloud Provisioning 2.1 before FP3 IF0001 allows remote authenticated users to modify virtual-system deployment via deployer.virtualsystems CLI commands, as demonstrated by a deletion using a deployer.virtualsystems[#].delete command.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21657949; https://exchange.xforce.ibmcloud.com/vulnerabilities/88254; http://www-01.ibm.com/support/docview.wss?uid=swg21657949
CVE: CVE-2013-6707
Published: 2013-12-07
Description: Memory leak in the connection-manager implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to cause a denial of service (multi-protocol management outage) by making multiple management session requests, aka Bug ID CSCug33233.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-772
References: http://osvdb.org/100682; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6707; http://tools.cisco.com/security/center/viewAlert.x?alertId=32065
CVE: CVE-2013-4171
Published: 2013-12-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the (1) RSS and (2) Atom feed templates.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rollerweblogger.org/project/entry/apache_roller_5_0_2; http://secunia.com/advisories/55862; http://secunia.com/advisories/55877
CVE: CVE-2013-4212
Published: 2013-12-07
Description: Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subclass of UIAction, aka "OGNL Injection."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://rollerweblogger.org/project/entry/apache_roller_5_0_2; http://secunia.com/advisories/55862; http://secunia.com/advisories/55877
CVE: CVE-2013-4445
Published: 2013-12-07
Description: The json rendering functionality in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal uses Drupal's token scheme to restrict access to blocks, which makes it easier for remote authenticated users to guess the access token for a block by leveraging the token from a block to which the user has access.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-November/121433.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122298.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122308.html
CVE: CVE-2013-4446
Published: 2013-12-07
Description: The _json_decode function in plugins/context_reaction_block.inc in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal, when using a version of PHP that does not support the json_decode function, allows remote attackers to execute arbitrary PHP code via unspecified vectors related to Ajax operations, possibly involving eval injection.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://drupalcode.org/project/context.git/commitdiff/63ef4d9; http://drupalcode.org/project/context.git/commitdiff/d7b4afa; http://lists.fedoraproject.org/pipermail/package-announce/2013-November/121433.html
CVE: CVE-2013-4478
Published: 2013-12-07
Description: Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://rubyforge.org/pipermail/sup-talk/2013-August/004993.html; http://rubyforge.org/pipermail/sup-talk/2013-October/004996.html; http://secunia.com/advisories/55294
CVE: CVE-2013-4479
Published: 2013-12-07
Description: lib/sup/message_chunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the content_type of an email attachment.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165917.html; http://rubyforge.org/pipermail/sup-talk/2013-October/004996.html; http://seclists.org/fulldisclosure/2013/Oct/272
CVE: CVE-2013-4505
Published: 2013-12-07
Description: The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00029.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00048.html; http://osvdb.org/100364
CVE: CVE-2013-4558
Published: 2013-12-07
Description: The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2013-12/msg00029.html; http://lists.opensuse.org/opensuse-updates/2013-12/msg00048.html; http://osvdb.org/100363
CVE: CVE-2013-6050
Published: 2013-12-07
Description: Integer overflow in Links before 2.8 allows remote attackers to cause a denial of service (crash) via crafted HTML tables.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://links.twibright.com/download/ChangeLog; http://www.debian.org/security/2013/dsa-2807; http://links.twibright.com/download/ChangeLog
CVE: CVE-2013-6397
Published: 2013-12-07
Description: Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT.  NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://lucene.apache.org/solr/4_6_0/changes/Changes.html; http://rhn.redhat.com/errata/RHSA-2013-1844.html; http://rhn.redhat.com/errata/RHSA-2014-0029.html
CVE: CVE-2013-6407
Published: 2013-12-07
Description: The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 6.4 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2013-1844.html; http://rhn.redhat.com/errata/RHSA-2014-0029.html; http://secunia.com/advisories/55542
CVE: CVE-2013-6408
Published: 2013-12-07
Description: The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
CVSS Score: 6.4 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2013-1844.html; http://rhn.redhat.com/errata/RHSA-2014-0029.html; http://secunia.com/advisories/55542