deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-1595
Published: 2019-03-06
Description: A vulnerability in the Fibre Channel over Ethernet (FCoE) protocol implementation in Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an incorrect allocation of an internal interface index. An adjacent attacker with the ability to submit a crafted FCoE packet that crosses affected interfaces could trigger this vulnerability. A successful exploit could allow the attacker to cause a packet loop and high throughput on the affected interfaces, resulting in a DoS condition. This vulnerability has been fixed in version 7.3(5)N1(1).
CVSS Score: 7.4 (HIGH)
CWE: CWE-913, CWE-913
References: http://www.securityfocus.com/bid/107320; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nexus-fbr-dos; http://www.securityfocus.com/bid/107320
CVE: CVE-2019-9606
Published: 2019-03-06
Description: PHP Scripts Mall Personal Video Collection Script 4.0.4 has Stored XSS via the "Update profile" feature.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://hackingvila.wordpress.com/2019/03/03/php-script-mall-personal-video-collection-script-has-stored-xss-in-edit-my-profile/; https://hackingvila.wordpress.com/2019/03/03/php-script-mall-personal-video-collection-script-has-stored-xss-in-edit-my-profile/
CVE: CVE-2019-9607
Published: 2019-03-06
Description: PHP Scripts Mall Medical Store Script 3.0.3 allows Path Traversal by navigating to the parent directory of a jpg or png file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://hackingvila.wordpress.com/2019/02/24/php-scripts-mall-medical-store-script-3-0-3-has-path-traversal/; https://hackingvila.wordpress.com/2019/02/24/php-scripts-mall-medical-store-script-3-0-3-has-path-traversal/
CVE: CVE-2019-9608
Published: 2019-03-06
Description: An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadImage URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.seebug.org/vuldb/ssvid-97832; https://www.seebug.org/vuldb/ssvid-97832
CVE: CVE-2019-9609
Published: 2019-03-06
Description: An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/comn/service/editUploadImage URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.seebug.org/vuldb/ssvid-97830; https://www.seebug.org/vuldb/ssvid-97830
CVE: CVE-2019-9610
Published: 2019-03-06
Description: An issue was discovered in OFCMS before 1.1.3. It has admin/cms/template/getTemplates.html?res_path=res&up_dir=../ directory traversal, related to the getTemplates function in TemplateController.java.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://www.seebug.org/vuldb/ssvid-97838; https://www.seebug.org/vuldb/ssvid-97838
CVE: CVE-2019-9611
Published: 2019-03-06
Description: An issue was discovered in OFCMS before 1.1.3. It allows admin/cms/template/getTemplates.html?res_path=res directory traversal, with ../ in the dir parameter, to write arbitrary content (in the file_content parameter) into an arbitrary file (specified by the file_name parameter). This is related to the save function in TemplateController.java.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.seebug.org/vuldb/ssvid-97839; https://www.seebug.org/vuldb/ssvid-97839
CVE: CVE-2019-9612
Published: 2019-03-06
Description: An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/comn/service/upload URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.seebug.org/vuldb/ssvid-97835; https://www.seebug.org/vuldb/ssvid-97835
CVE: CVE-2019-9613
Published: 2019-03-06
Description: An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadVideo URI.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://www.seebug.org/vuldb/ssvid-97834; https://www.seebug.org/vuldb/ssvid-97834
CVE: CVE-2019-9614
Published: 2019-03-06
Description: An issue was discovered in OFCMS before 1.1.3. A command execution vulnerability exists via a template file with '<#assign ex="freemarker.template.utility.Execute"?new()> ${ ex("' followed by the command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://www.seebug.org/vuldb/ssvid-97837; https://www.seebug.org/vuldb/ssvid-97837
CVE: CVE-2019-9615
Published: 2019-03-06
Description: An issue was discovered in OFCMS before 1.1.3. It allows admin/system/generate/create?sql= SQL injection, related to SystemGenerateController.java.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://www.seebug.org/vuldb/ssvid-97836; https://www.seebug.org/vuldb/ssvid-97836
CVE: CVE-2019-9616
Published: 2019-03-06
Description: An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadScrawl URI.
CVSS Score: 7.2 (HIGH)
CWE: CWE-706
References: https://www.seebug.org/vuldb/ssvid-97833; https://www.seebug.org/vuldb/ssvid-97833
CVE: CVE-2019-9617
Published: 2019-03-06
Description: An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadFile URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.seebug.org/vuldb/ssvid-97831; https://www.seebug.org/vuldb/ssvid-97831
CVE: CVE-2019-9622
Published: 2019-03-07
Description: eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as demonstrated by reading the user-data/save/backup.sql file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://pentest.com.tr/exploits/Brigade-ERP-4-5-Database-Backup-Disclosure-via-AFD.html; https://sourceforge.net/p/ebrigade/code/5912/; https://www.exploit-db.com/exploits/46109
CVE: CVE-2019-9623
Published: 2019-03-07
Description: Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "<!--#exec cmd=" in a .shtml file to ck_upload_handler.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://pentest.com.tr/exploits/Feng-Office-3-7-0-5-Unauthenticated-Remote-Command-Execution-Metasploit.html; https://www.exploit-db.com/exploits/46471; https://pentest.com.tr/exploits/Feng-Office-3-7-0-5-Unauthenticated-Remote-Command-Execution-Metasploit.html
CVE: CVE-2019-9624
Published: 2019-03-07
Description: Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://www.rapid7.com/db/modules/exploit/unix/webapp/webmin_upload_exec; https://pentest.com.tr/exploits/Webmin-1900-Remote-Command-Execution.html; https://www.exploit-db.com/exploits/46201
CVE: CVE-2019-9625
Published: 2019-03-07
Description: JBMC DirectAdmin 1.55 allows CSRF via the /CMD_ACCOUNT_ADMIN URI to create a new admin account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/ManhNho/CVEs/blob/master/New-Requests/DirectAdmin-CSRF; https://www.exploit-db.com/exploits/46520/; https://github.com/ManhNho/CVEs/blob/master/New-Requests/DirectAdmin-CSRF
CVE: CVE-2019-9626
Published: 2019-03-07
Description: PHPSHE 1.7 allows module/index/cart.php pintuan_id SQL Injection to index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gitee.com/koyshe/phpshe/issues/ISW87; https://gitee.com/koyshe/phpshe/issues/ISW87
CVE: CVE-2018-11783
Published: 2019-03-07
Description: sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/107032; https://lists.apache.org/thread.html/4f102f[PII_REDACTED]32fb1fb653d687c7b69d29d9792f0d6cf72c505e%40%3Cannounce.trafficserver.apache.org%3E; http://www.securityfocus.com/bid/107032
CVE: CVE-2019-3712
Published: 2019-03-07
Description: Dell WES Wyse Device Agent versions prior to 14.1.2.9 and Dell Wyse ThinLinux HAgent versions prior to 5.4.55 00.10 contain a buffer overflow vulnerability. An unauthenticated attacker may potentially exploit this vulnerability to execute arbitrary code on the system with privileges of the FTP client by sending specially crafted input data to the affected system. The FTP code that contained the vulnerability has been removed.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/107376; https://www.dell.com/support/article/us/en/19/sln316391; http://www.securityfocus.com/bid/107376
CVE: CVE-2019-3775
Published: 2019-03-07
Description: Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user.
CVSS Score: 7.1 (HIGH)
CWE: CWE-290, CWE-287
References: https://www.cloudfoundry.org/blog/cve-2019-3775; https://www.cloudfoundry.org/blog/cve-2019-3775
CVE: CVE-2019-3776
Published: 2019-03-07
Description: Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote user that is able to convince an Operations Manager user to interact with malicious content could execute arbitrary JavaScript in the user's browser.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/107344; https://pivotal.io/security/cve-2019-3776; http://www.securityfocus.com/bid/107344
CVE: CVE-2019-3777
Published: 2019-03-07
Description: Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Controller
CVSS Score: 8.0 (HIGH)
CWE: CWE-295, CWE-295
References: http://www.securityfocus.com/bid/107214; https://pivotal.io/security/cve-2019-3777; http://www.securityfocus.com/bid/107214
CVE: CVE-2019-3778
Published: 2019-03-07
Description: Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-601
References: http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html; http://www.securityfocus.com/bid/107153; https://pivotal.io/security/cve-2019-3778
CVE: CVE-2019-3781
Published: 2019-03-07
Description: Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authenticated malicious user with access to logs may gain part or all of a users password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-215, CWE-200
References: http://www.securityfocus.com/bid/107365; https://www.cloudfoundry.org/blog/cve-2019-3781; http://www.securityfocus.com/bid/107365
CVE: CVE-2019-3783
Published: 2019-03-07
Description: Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brute force another user's current Stratos session, and act on behalf of that user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384, CWE-1188
References: https://www.cloudfoundry.org/blog/cve-2019-3783; https://www.cloudfoundry.org/blog/cve-2019-3783
CVE: CVE-2019-3784
Published: 2019-03-07
Description: Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using the default embedded SQLite database, a remote authenticated malicious user can switch sessions to another user with the same session id.
CVSS Score: 8.2 (HIGH)
CWE: CWE-384, CWE-384
References: https://www.cloudfoundry.org/blog/cve-2019-3784; https://www.cloudfoundry.org/blog/cve-2019-3784
CVE: CVE-2019-1596
Published: 2019-03-07
Description: A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level to root. The attacker must authenticate with valid user credentials. The vulnerability is due to incorrect permissions of a system executable. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the Bash prompt. A successful exploit could allow the attacker to escalate their privilege level to root. Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).
CVSS Score: 7.8 (HIGH)
CWE: CWE-264, CWE-732
References: http://www.securityfocus.com/bid/107340; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-pe; http://www.securityfocus.com/bid/107340
CVE: CVE-2019-1597
Published: 2019-03-07
Description: Multiple vulnerabilities in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of LDAP packets by an affected device. An attacker could exploit these vulnerabilities by sending an LDAP packet crafted using Basic Encoding Rules (BER) to an affected device. The LDAP packet must have a source IP address of an LDAP server configured on the targeted device. A successful exploit could cause the affected device to reload, resulting in a DoS condition. Firepower 4100 Series Next-Generation Firewalls are affected in versions prior to 2.0.1.201, 2.2.2.54, and 2.3.1.75. Firepower 9300 Security Appliances are affected in versions prior to 2.0.1.201, 2.2.2.54 and 2.3.1.75. MDS 9000 Series Multilayer Switches are affected in versions prior to 8.2(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(1). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(2). Nexus 7000 and 7700 Series Switches are affected in versions prior to 8.2(1). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(1). Cisco UCS 6200 and 6300 Fabric Interconnect devices are affected in versions prior to 3.2(2b).
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/107394; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxosldap; http://www.securityfocus.com/bid/107394
CVE: CVE-2019-1598
Published: 2019-03-07
Description: Multiple vulnerabilities in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of LDAP packets by an affected device. An attacker could exploit these vulnerabilities by sending an LDAP packet crafted using Basic Encoding Rules (BER) to an affected device. The LDAP packet must have a source IP address of an LDAP server configured on the targeted device. A successful exploit could cause the affected device to reload, resulting in a DoS condition. Firepower 4100 Series Next-Generation Firewalls are affected in versions prior to 2.0.1.201, 2.2.2.54, and 2.3.1.75. Firepower 9300 Security Appliances are affected in versions prior to 2.0.1.201, 2.2.2.54, and 2.3.1.75. MDS 9000 Series Multilayer Switches are affected in versions prior to 8.2(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(1). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(2). Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(20), 7.3(2)D1(1), and 8.2(1). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(1). UCS 6200 and 6300 Fabric Interconnect are affected in versions prior to 3.2(2b).
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/107394; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxosldap; http://www.securityfocus.com/bid/107394
CVE: CVE-2019-1599
Published: 2019-03-07
Description: A vulnerability in the network stack of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to an issue with allocating and freeing memory buffers in the network stack. An attacker could exploit this vulnerability by sending crafted TCP streams to an affected device in a sustained way. A successful exploit could cause the network stack of an affected device to run out of available buffers, impairing operations of control plane and management plane protocols, resulting in a DoS condition. Note: This vulnerability can be triggered only by traffic that is destined to an affected device and cannot be exploited using traffic that transits an affected device. Nexus 1000V Switch for Microsoft Hyper-V is affected in versions prior to 5.2(1)SM3(2.1). Nexus 1000V Switch for VMware vSphere is affected in versions prior to 5.2(1)SV3(4.1a). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(6) and 9.2(2). Nexus 3500 Platform Switches are affected in versions prior to 6.0(2)A8(11), 7.0(3)I7(6), and 9.2(2). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5) and 9.2(2). Nexus 5500, 5600, and 6000 Series Switches are affected in versions prior to 7.1(5)N1(1b) and 7.3(5)N1(1). Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(22. Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5) and 9.2(2). UCS 6200 and 6300 Series Fabric Interconnect are affected in versions prior to 3.2(3j) and 4.0(2a). UCS 6400 Series Fabric Interconnect are affected in versions prior to 4.0(2a).
CVSS Score: 8.6 (HIGH)
CWE: CWE-399, CWE-770
References: http://www.securityfocus.com/bid/107342; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-netstack; http://www.securityfocus.com/bid/107342
CVE: CVE-2019-1600
Published: 2019-03-07
Description: A vulnerability in the file system permissions of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to access sensitive information that is stored in the file system of an affected system. The vulnerability is due to improper implementation of file system permissions. An attacker could exploit this vulnerability by accessing and modifying restricted files. A successful exploit could allow the attacker to access sensitive and critical files. Firepower 4100 Series Next-Generation Firewalls are affected in versions prior to 2.2.2.91 and 2.3.1.110. Firepower 9300 Series Next-Generation Firewalls are affected in versions prior to 2.2.2.91 and 2.3.1.110. MDS 9000 Series Multilayer Switches are affected in versions prior to 6.2(25), 8.1(1b), and 8.3(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 6.0(2)A8(10) and 7.0(3)I7(4). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 2000, 5500, 5600, and 6000 Series Switches are affected in versions prior to 7.1(5)N1(1b) and 7.3(3)N1(1). Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(22), 7.3(3)D1(1), and 8.2(3). Nexus 9000 Series Switches-Standalone are affected in versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264, CWE-732
References: http://www.securityfocus.com/bid/107399; http://www.securityfocus.com/bid/107404; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-directory
CVE: CVE-2019-5019
Published: 2019-03-07
Description: A heap-based overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server Document Converter V7.0 Pro R1 (7,0,2018,1113). While parsing Document Summary Property Set stream, the getSummaryInformation function is incorrectly checking the correlation between size and the number of properties in PropertySet packets, causing an out-of-bounds write that leads to heap corruption and consequent code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0780; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0780
CVE: CVE-2019-0192
Published: 2019-03-07
Description: In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://mail-archives.us.apache.org/mod_mbox/www-announce/201903.mbox/%3CCAECwjAV1buZwg%2BMcV9EAQ19MeAWztPVJYD4zGK8kQdADFYij1w%40mail.gmail.com%3E; http://www.securityfocus.com/bid/107318; https://access.redhat.com/errata/RHSA-2019:2413