Elastic

396 results · Feed

• Unscored —
  CVE-2018-3823

  X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with mana…

  Elastic Elasticsearch X-Pack Machine Learning
  Sep 19, 2018
• Unscored —
  CVE-2018-3826

  In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key an…

  Elastic Elasticsearch
  Sep 19, 2018
• Unscored —
  CVE-2018-3829

  In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on n…

  Elastic Elastic Cloud Enterprise
  Sep 19, 2018
• Unscored —
  CVE-2018-3825

  In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of gra…

  Elastic Elastic Cloud Enterprise (ECE)
  Sep 19, 2018
• Medium 6.1
  CVE-2018-3824

  Elasticsearch subject to cross site scripting

  X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could a…

  Elastic Elasticsearch X-Pack Machine Learning org.elasticsearch:elasticsearch Maven
  Sep 19, 2018
• Unscored —
  CVE-2018-3828

  Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered…

  Elastic Elastic Cloud Enterprise
  Sep 19, 2018
• Unscored —
  CVE-2018-3820

  Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that…

  Elastic Kibana
  Mar 30, 2018
• Unscored —
  CVE-2018-3819

  The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 …

  Elastic Kibana
  Mar 30, 2018
• Unscored —
  CVE-2018-3821

  Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud …

  Elastic Kibana
  Mar 30, 2018
• Unscored —
  CVE-2018-3822

  X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect XML canoni…

  Elastic X-Pack Security
  Mar 30, 2018
• Unscored —
  CVE-2018-3817

  When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log…

  Elastic Logstash
  Mar 30, 2018
• Unscored —
  CVE-2018-3818

  Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatte…

  Elastic Kibana
  Mar 30, 2018
• Unscored —
  CVE-2017-11482

  The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.…

  Elastic Kibana
  Dec 8, 2017
• High 7.5
  CVE-2017-11480

  Denial of Service in Packetbeat

  Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. If Packetbeat is listening for PostgreSQL traffic and a user is able to send arbitrary network traffic to the monitored port, the attacker could pr…

  Elastic Packetbeat github.com/elastic/beats Go
  Dec 8, 2017
• Unscored —
  CVE-2017-11481

  Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow…

  Elastic Kibana
  Dec 8, 2017
• Unscored —
  CVE-2017-8447

  An error was found in the X-Pack Security 5.3.0 to 5.5.2 privilege enforcement. If a user has either 'delete' or 'index…

  Elastic Elastic X-Pack Security
  Sep 28, 2017
• Unscored —
  CVE-2017-8444

  The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper. …

  Elastic Elastic Cloud Enterprise
  Sep 28, 2017
• Unscored —
  CVE-2017-8448

  An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built…

  Elastic Elastic X-Pack Alerting
  Sep 28, 2017
• Unscored —
  CVE-2017-8445

  An error was found in the X-Pack Security TLS trust manager for versions 5.0.0 to 5.5.1. If reloading the trust materia…

  Elastic Elastic X-Pack Security
  Aug 18, 2017
• Medium 5.3
  CVE-2017-8446

  Improper Privilege Management in X-Pack

  The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reporting_user role could execute a report with the permissions of another reportin…

  Elastic Elastic X-Pack Reporting org.elasticsearch.plugin:x-pack Maven
  Aug 18, 2017
• Unscored —
  CVE-2017-8442

  Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking…

  Elastic Elasticsearch X-Pack Security
  Jul 7, 2017
• Unscored —
  CVE-2017-8443

  In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a red…

  Elastic Kibana X-Pack Security
  Jun 30, 2017
• Unscored —
  CVE-2015-9056

  Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a XSS attack.

  Elastic Kibana
  Jun 16, 2017
• Unscored —
  CVE-2016-10364

  With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings a…

  Elastic Elastic X-Pack Security
  Jun 16, 2017
• Unscored —
  CVE-2016-10363

  Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5,…

  Elastic Logstash
  Jun 16, 2017
• Unscored —
  CVE-2016-10365

  Kibana versions before 4.6.3 and 5.0.1 have an open redirect vulnerability that would enable an attacker to craft a lin…

  Elastic Kibana
  Jun 16, 2017
• Medium 6.5
  CVE-2016-10362

  Logstash Logs Sensitive Information

  Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials.

  Elastic Logstash logstash-core RubyGems
  Jun 16, 2017
• Unscored —
  CVE-2016-10366

  Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack.

  Elastic Kibana
  Jun 16, 2017
• Unscored —
  CVE-2017-8451

  With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would en…

  Elastic Elastic X-Pack Security
  Jun 16, 2017
• Unscored —
  CVE-2017-8450

  X-Pack 5.1.1 did not properly apply document and field level security to multi-search and multi-get requests so users w…

  Elastic Elastic X-Pack Security
  Jun 16, 2017
• Unscored —
  CVE-2017-8452

  Kibana versions prior to 5.2.1 configured for SSL client access, file descriptors will fail to be cleaned up after cert…

  Elastic Kibana
  Jun 16, 2017
• Unscored —
  CVE-2017-8449

  X-Pack Security 5.2.x would allow access to more fields than the user should have seen if the field level security rule…

  Elastic Elastic X-Pack Security
  Jun 16, 2017
• Unscored —
  CVE-2017-8438

  Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bu…

  Elastic X-Pack Security
  Jun 5, 2017
• Unscored —
  CVE-2017-8440

  Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow …

  Elastic Kibana
  Jun 5, 2017
• Unscored —
  CVE-2017-8441

  Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to ind…

  Elastic X-Pack Security
  Jun 5, 2017
• Unscored —
  CVE-2017-8439

  Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could…

  Elastic Kibana
  Jun 5, 2017