Elastic
Page 3 of 3 — Elastic CVEs from a corpus of 248, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46667 | High | 8.1 | 2023-10-26 | An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text… |
CVE-2023-46668 | Medium | 4.6 | 2023-10-26 | If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent… |
CVE-2023-31415 | High | 8.8 | 2023-05-04 | Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will… |
CVE-2023-31414 | High | 8.8 | 2023-05-04 | Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a spe… |
CVE-2023-31413 | Low | 3.3 | 2023-05-04 | Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization header contents to b… |
CVE-2022-38779 | Medium | 6.1 | 2023-02-22 | An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. |
CVE-2022-38778 | Medium | 6.5 | 2023-02-08 | A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes th… |
CVE-2022-38777 | High | 7.8 | 2023-02-08 | An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to t… |
CVE-2022-38775 | High | 7.8 | 2023-01-26 | An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to t… |
CVE-2022-38774 | High | 7.8 | 2023-01-26 | An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which could allow unprivileged users to elevate… |
CVE-2021-37936 | Medium | 5.4 | 2022-11-18 | It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write docu… |
CVE-2021-22141 | Medium | 6.1 | 2022-11-18 | An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana re… |
CVE-2022-23716 | Medium | 5.3 | 2022-09-28 | A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in t… |
CVE-2022-23715 | Medium | 6.5 | 2022-08-25 | A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings… |
CVE-2022-23714 | High | 7.8 | 2022-07-06 | A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Security for Windows, which could allow unprivi… |
CVE-2022-23713 | Medium | 6.1 | 2022-07-06 | A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a vict… |
CVE-2022-23712 | High | 7.5 | 2022-06-06 | A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node… |
CVE-2022-23711 | Medium | 5.3 | 2022-04-21 | A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features p… |
CVE-2022-23710 | Medium | 6.1 | 2022-03-03 | A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary… |
CVE-2022-23709 | Medium | 4.3 | 2022-03-03 | A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to… |
CVE-2022-23708 | Medium | 4.3 | 2022-03-03 | A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the sec… |
CVE-2022-23707 | Medium | 5.4 | 2022-02-11 | An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject m… |
CVE-2021-37941 | High | 7.8 | 2021-12-08 | A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with t… |
CVE-2021-37940 | Medium | 6.8 | 2021-12-07 | An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integrati… |
CVE-2021-37939 | Low | 2.7 | 2021-11-18 | It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentional… |
CVE-2021-37938 | Medium | 4.3 | 2021-11-18 | It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this… |
CVE-2021-22149 | High | 8.8 | 2021-09-15 | Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using… |
CVE-2021-22148 | High | 8.8 | 2021-09-15 | Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as their creator. This… |
CVE-2021-22147 | Medium | 6.5 | 2021-09-15 | Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to… |
CVE-2021-22144 | Medium | 6.5 | 2021-07-26 | In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the… |
CVE-2021-22146 | High | 7.5 | 2021-07-21 | All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anony… |
CVE-2021-22145 | Medium | 6.5 | 2021-07-21 | A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elas… |
CVE-2020-10743 | Medium | 4.3 | 2021-06-02 | It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate… |
CVE-2021-22140 | High | 7.5 | 2021-05-13 | Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Usi… |
CVE-2021-22139 | Medium | 6.5 | 2021-05-13 | Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request siz… |
CVE-2021-22138 | Low | 3.7 | 2021-05-13 | In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted… |
CVE-2021-22137 | Medium | 5.3 | 2021-05-13 | In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not pr… |
CVE-2021-22136 | Low | 3.5 | 2021-05-13 | In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being resp… |
CVE-2021-22135 | Medium | 5.3 | 2021-05-13 | Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and F… |
CVE-2021-22134 | Medium | 4.3 | 2021-03-08 | A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not… |
CVE-2021-22133 | Low | 2.4 | 2021-02-10 | The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally… |
CVE-2020-7021 | Medium | 4.9 | 2021-02-10 | Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasti… |
CVE-2021-22132 | Medium | 4.8 | 2021-01-14 | Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store… |
CVE-2020-27816 | Medium | 6.1 | 2020-12-02 | The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original open… |
CVE-2020-7020 | Low | 3.1 | 2020-10-22 | Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly… |
CVE-2020-7019 | Medium | 6.5 | 2020-08-18 | In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same q… |
CVE-2020-7018 | High | 8.8 | 2020-08-18 | Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the �developer� role, they will b… |
CVE-2020-7017 | Medium | 6.7 | 2020-07-27 | In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. An attacker who is able to edit or create a region map v… |
CVE-2020-7016 | Medium | 4.8 | 2020-07-27 | Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user c… |
CVE-2020-7015 | Medium | 5.4 | 2020-06-03 | Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVB visualization cou… |
CVE-2020-7014 | High | 8.8 | 2020-06-03 | The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an a… |
CVE-2020-7013 | High | 7.2 | 2020-06-03 | Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations coul… |
CVE-2020-7012 | High | 8.8 | 2020-06-03 | Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to wri… |
CVE-2020-7011 | Medium | 6.1 | 2020-06-03 | Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injec… |
CVE-2020-7010 | High | 7.5 | 2020-06-03 | Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the… |
CVE-2020-7009 | High | 8.8 | 2020-03-31 | Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacke… |
CVE-2019-7621 | Medium | 5.4 | 2019-12-18 | Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations. An attacker with the ability… |
CVE-2019-7620 | High | 7.5 | 2019-10-30 | Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthenticated user who is able to connect to… |
CVE-2019-7619 | Medium | 5.3 | 2019-10-30 | Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send… |
CVE-2019-7618 | Medium | 6.5 | 2019-10-01 | A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to… |
CVE-2019-7617 | High | 7.2 | 2019-08-22 | When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the pr… |
CVE-2019-7616 | Medium | 4.9 | 2019-07-30 | Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with… |
CVE-2019-7615 | High | 7.4 | 2019-07-30 | A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the 'serve… |
CVE-2019-7614 | Medium | 5.9 | 2019-07-30 | A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users sub… |
CVE-2019-7613 | High | 7.5 | 2019-03-25 | Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw. An attacker able to inject certain characters into a log entry could prevent Winl… |
CVE-2019-7612 | Critical | 9.8 | 2019-03-25 | A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of… |
CVE-2019-7611 | High | 8.1 | 2019-03-25 | A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _alia… |
CVE-2019-7610 | Critical | 9.0 | 2019-03-25 | Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.e… |
CVE-2019-7609 | Critical | 10.0 | 2019-03-25 | Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion applicatio… |
CVE-2019-7608 | Medium | 6.1 | 2019-03-25 | Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or per… |
CVE-2018-17247 | Medium | 5.9 | 2018-12-20 | Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access… |
CVE-2018-17246 | Critical | 9.8 | 2018-12-20 | Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could… |
CVE-2018-17245 | Critical | 9.8 | 2018-12-20 | Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a re… |
CVE-2018-17244 | Medium | 6.5 | 2018-12-20 | Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Nativ… |
CVE-2018-3831 | High | 8.8 | 2018-09-19 | Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elas… |
CVE-2018-3830 | Medium | 6.1 | 2018-09-19 | Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive i… |
CVE-2018-3829 | Medium | 5.3 | 2018-09-19 | In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on new hosts with an invalid roles token. An… |
CVE-2018-3828 | High | 7.5 | 2018-09-19 | Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would… |
CVE-2018-3827 | High | 8.1 | 2018-09-19 | A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repository-azure plugin… |
CVE-2018-3826 | Medium | 6.5 | 2018-09-19 | In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using… |
CVE-2018-3825 | Medium | 5.9 | 2018-09-19 | In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch… |
CVE-2018-3824 | Medium | 6.1 | 2018-09-19 | X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index tha… |
CVE-2018-3823 | Medium | 5.4 | 2018-09-19 | X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions could create jobs cont… |
CVE-2018-3822 | Critical | 9.8 | 2018-03-30 | X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect XML canonicalization and DOM traversal. An attacke… |
CVE-2018-3821 | Medium | 6.1 | 2018-03-30 | Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud visualization that could allow an attack… |
CVE-2018-3820 | Medium | 6.1 | 2018-03-30 | Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that could allow an attacker to obtain sensi… |
CVE-2018-3819 | Medium | 6.1 | 2018-03-30 | The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect vulnerability on t… |
CVE-2018-3818 | Medium | 6.1 | 2018-03-30 | Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow an attacker to obtain… |
CVE-2018-3817 | Medium | 6.5 | 2018-03-30 | When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive information. |
CVE-2015-5377 | Critical | 9.8 | 2018-03-06 | Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to cl… |
CVE-2017-11482 | Medium | 6.1 | 2017-12-08 | The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redirect vulnerability… |
CVE-2017-11481 | Medium | 6.1 | 2017-12-08 | Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtain sensitive informa… |
CVE-2017-11480 | High | 7.5 | 2017-12-08 | Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. If Packetbeat is listening for PostgreSQL traff… |
CVE-2017-8448 | High | 8.8 | 2017-09-29 | An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could create a watch that resu… |
CVE-2017-8447 | Medium | 6.5 | 2017-09-29 | An error was found in the X-Pack Security 5.3.0 to 5.5.2 privilege enforcement. If a user has either 'delete' or 'index' permissions on an index in a cluster… |
CVE-2017-8444 | Medium | 5.9 | 2017-09-29 | The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper. If an attacker is able to man in the mid… |
CVE-2017-11479 | Medium | 6.1 | 2017-09-29 | Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive information from or… |
CVE-2017-8446 | Medium | 5.3 | 2017-08-18 | The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability… |
CVE-2017-8445 | Medium | 5.5 | 2017-08-18 | An error was found in the X-Pack Security TLS trust manager for versions 5.0.0 to 5.5.1. If reloading the trust material fails the trust manager will be replac… |
CVE-2015-5619 | Medium | 5.9 | 2017-08-09 | Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash se… |