Filtered by vendor Elastic
Subscribe
Total
145 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-22139 | 1 Elastic | 1 Kibana | 2021-05-21 | 4.0 MEDIUM | 6.5 MEDIUM |
| Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create webhook actions could drain the Kibana host connection pool, making Kibana unavailable for all other users. | |||||
| CVE-2020-7021 | 1 Elastic | 1 Elasticsearch | 2021-03-26 | 4.0 MEDIUM | 4.9 MEDIUM |
| Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details. | |||||
| CVE-2021-22133 | 1 Elastic | 1 Apm Agent | 2021-02-16 | 2.7 LOW | 2.4 LOW |
| The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent. | |||||
| CVE-2020-27816 | 2 Elastic, Redhat | 2 Kibana, Openshift Container Platform | 2020-12-04 | 5.8 MEDIUM | 6.1 MEDIUM |
| The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift-logging console link damage. This flaw affects elasticsearch-operator-container versions before 4.7. | |||||
| CVE-2019-7611 | 1 Elastic | 1 Elasticsearch | 2020-10-19 | 6.8 MEDIUM | 8.1 HIGH |
| A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index. | |||||
| CVE-2020-7015 | 1 Elastic | 1 Kibana | 2020-10-19 | 3.5 LOW | 5.4 MEDIUM |
| Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVB visualization could allow the attacker to obtain sensitive information from, or perform destructive actions, on behalf of Kibana users who edit the TSVB visualization. | |||||
| CVE-2020-7013 | 2 Elastic, Redhat | 2 Kibana, Openshift Container Platform | 2020-10-19 | 6.5 MEDIUM | 7.2 HIGH |
| Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system. | |||||
| CVE-2019-7621 | 1 Elastic | 1 Kibana | 2020-10-19 | 3.5 LOW | 5.4 MEDIUM |
| Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations. An attacker with the ability to create coordinate map visualizations could create a malicious visualization. If another Kibana user views that visualization or a dashboard containing the visualization it could execute JavaScript in the victim�s browser. | |||||
| CVE-2018-3819 | 1 Elastic | 1 Kibana | 2020-10-19 | 5.8 MEDIUM | 6.1 MEDIUM |
| The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website. | |||||
| CVE-2017-8451 | 1 Elastic | 1 Kibana | 2020-10-19 | 5.8 MEDIUM | 6.1 MEDIUM |
| With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website. | |||||
| CVE-2015-8131 | 1 Elastic | 1 Kibana | 2020-10-19 | 6.8 MEDIUM | N/A |
| Cross-site request forgery (CSRF) vulnerability in Elasticsearch Kibana before 4.1.3 and 4.2.x before 4.2.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. | |||||
| CVE-2017-8452 | 1 Elastic | 1 Kibana | 2020-10-19 | 5.0 MEDIUM | 7.5 HIGH |
| Kibana versions prior to 5.2.1 configured for SSL client access, file descriptors will fail to be cleaned up after certain requests and will accumulate over time until the process crashes. | |||||
| CVE-2017-8443 | 1 Elastic | 1 Kibana | 2020-10-19 | 4.3 MEDIUM | 6.5 MEDIUM |
| In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be viewed by untrusted parties or logged into the Kibana access logs. | |||||
| CVE-2016-10365 | 1 Elastic | 1 Kibana | 2020-10-19 | 5.8 MEDIUM | 6.1 MEDIUM |
| Kibana versions before 4.6.3 and 5.0.1 have an open redirect vulnerability that would enable an attacker to craft a link in the Kibana domain that redirects to an arbitrary website. | |||||
| CVE-2019-7618 | 1 Elastic | 1 Kibana | 2020-10-16 | 3.5 LOW | 6.5 MEDIUM |
| A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with the permission of the Kibana system user. | |||||
| CVE-2019-7620 | 1 Elastic | 1 Logstash | 2020-10-09 | 5.0 MEDIUM | 7.5 HIGH |
| Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthenticated user who is able to connect to the port the Logstash beats input could send a specially crafted network packet that would cause Logstash to stop responding. | |||||
| CVE-2019-7613 | 1 Elastic | 1 Winlogbeat | 2020-10-06 | 5.0 MEDIUM | 7.5 HIGH |
| Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw. An attacker able to inject certain characters into a log entry could prevent Winlogbeat from recording the event. | |||||
| CVE-2019-7612 | 2 Elastic, Netapp | 2 Logstash, Active Iq Performance Analytics Services | 2020-10-05 | 5.0 MEDIUM | 9.8 CRITICAL |
| A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message. | |||||
| CVE-2018-3827 | 1 Elastic | 1 Azure Repository | 2020-09-18 | 4.3 MEDIUM | 8.1 HIGH |
| A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged. | |||||
| CVE-2020-7018 | 1 Elastic | 1 Enterprise Search | 2020-08-26 | 4.0 MEDIUM | 8.8 HIGH |
| Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the �developer� role, they will be able to view the administrator API credentials. These credentials could allow the developer user to conduct operations with the same permissions of the App Search administrator. | |||||