CVE Daily – Apache Lucene https://cvedaily.com/pages/tags/apache-lucene.html CVE Daily – Apache Lucene en Wed, 03 Jun 2026 21:27:07 +0000 [High] CVE-2024-43383 – Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator... https://nvd.nist.gov/vuln/detail/CVE-2024-43383 https://nvd.nist.gov/vuln/detail/CVE-2024-43383 Thu, 31 Oct 2024 10:15:04 +0000 High CVE-2024-43383

Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016. An attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provi…

CVSS: 8.0 · CWE: CWE-502

View on NVD

]]> [Medium] CVE-2024-45772 – Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator. Th... https://nvd.nist.gov/vuln/detail/CVE-2024-45772 https://nvd.nist.gov/vuln/detail/CVE-2024-45772 Mon, 30 Sep 2024 09:15:02 +0000 Medium CVE-2024-45772

Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator. This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. The deprecated org.apache.lucene.replicator.http package is affected. The org.apache.lucene.replicator.nrt package is not affected. Users are recommended to upgrade to version 9.12.0, which fixes the issue. The deserialization can only be…

CVSS: 5.1 · CWE: CWE-502

View on NVD

]]> [Medium] CVE-2024-33647 – A vulnerability has been identified in Polarion ALM (All versions < V2404.0). Th... https://nvd.nist.gov/vuln/detail/CVE-2024-33647 https://nvd.nist.gov/vuln/detail/CVE-2024-33647 Tue, 14 May 2024 16:17:21 +0000 Medium CVE-2024-33647

A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The Apache Lucene based query engine in the affected application lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects.

CVSS: 6.5 · CWE: CWE-284

View on NVD

]]> [Critical] CVE-2017-12629 – Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before... https://nvd.nist.gov/vuln/detail/CVE-2017-12629 https://nvd.nist.gov/vuln/detail/CVE-2017-12629 Sat, 14 Oct 2017 23:29:00 +0000 Critical CVE-2017-12629

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for a…

CVSS: 9.8 · CWE: CWE-611

View on NVD

]]>