Elastic
Page 4 of 4 — Elastic CVEs from a corpus of 382, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7018 | High | 8.8 | 2020-08-18 | Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the �developer� role, they will b… |
CVE-2020-7017 | Medium | 6.7 | 2020-07-27 | In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. An attacker who is able to edit or create a region map v… |
CVE-2020-7016 | Medium | 4.8 | 2020-07-27 | Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user c… |
CVE-2020-7015 | Medium | 5.4 | 2020-06-03 | Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVB visualization cou… |
CVE-2020-7014 | High | 8.8 | 2020-06-03 | The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an a… |
CVE-2020-7013 | High | 7.2 | 2020-06-03 | Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations coul… |
CVE-2020-7012 | High | 8.8 | 2020-06-03 | Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to wri… |
CVE-2020-7011 | Medium | 6.1 | 2020-06-03 | Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injec… |
CVE-2020-7010 | High | 7.5 | 2020-06-03 | Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the… |
CVE-2020-7009 | High | 8.8 | 2020-03-31 | Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacke… |
CVE-2019-7621 | Medium | 5.4 | 2019-12-18 | Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations. An attacker with the ability… |
CVE-2019-7620 | High | 7.5 | 2019-10-30 | Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthenticated user who is able to connect to… |
CVE-2019-7619 | Medium | 5.3 | 2019-10-30 | Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send… |
CVE-2019-7618 | Medium | 6.5 | 2019-10-01 | A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to… |
CVE-2019-7617 | High | 7.2 | 2019-08-22 | When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the pr… |
CVE-2019-7616 | Medium | 4.9 | 2019-07-30 | Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with… |
CVE-2019-7615 | High | 7.4 | 2019-07-30 | A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the 'serve… |
CVE-2019-7614 | Medium | 5.9 | 2019-07-30 | A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users sub… |
CVE-2019-7613 | High | 7.5 | 2019-03-25 | Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw. An attacker able to inject certain characters into a log entry could prevent Winl… |
CVE-2019-7612 | Critical | 9.8 | 2019-03-25 | A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of… |
CVE-2019-7611 | High | 8.1 | 2019-03-25 | A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _alia… |
CVE-2019-7610 | Critical | 9.0 | 2019-03-25 | Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.e… |
CVE-2019-7609 | Critical | 10.0 | 2019-03-25 | Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion applicatio… |
CVE-2019-7608 | Medium | 6.1 | 2019-03-25 | Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or per… |
CVE-2018-17247 | Medium | 5.9 | 2018-12-20 | Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access… |
CVE-2018-17246 | Critical | 9.8 | 2018-12-20 | Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could… |
CVE-2018-17245 | Critical | 9.8 | 2018-12-20 | Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a re… |
CVE-2018-17244 | Medium | 6.5 | 2018-12-20 | Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Nativ… |
CVE-2018-3831 | High | 8.8 | 2018-09-19 | Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elas… |
CVE-2018-3830 | Medium | 6.1 | 2018-09-19 | Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive i… |
CVE-2018-3829 | Medium | 5.3 | 2018-09-19 | In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on new hosts with an invalid roles token. An… |
CVE-2018-3828 | High | 7.5 | 2018-09-19 | Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would… |
CVE-2018-3827 | High | 8.1 | 2018-09-19 | A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repository-azure plugin… |
CVE-2018-3826 | Medium | 6.5 | 2018-09-19 | In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using… |
CVE-2018-3825 | Medium | 5.9 | 2018-09-19 | In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch… |
CVE-2018-3824 | Medium | 6.1 | 2018-09-19 | X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index tha… |
CVE-2018-3823 | Medium | 5.4 | 2018-09-19 | X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions could create jobs cont… |
CVE-2018-3822 | Critical | 9.8 | 2018-03-30 | X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect XML canonicalization and DOM traversal. An attacke… |
CVE-2018-3821 | Medium | 6.1 | 2018-03-30 | Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud visualization that could allow an attack… |
CVE-2018-3820 | Medium | 6.1 | 2018-03-30 | Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that could allow an attacker to obtain sensi… |
CVE-2018-3819 | Medium | 6.1 | 2018-03-30 | The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect vulnerability on t… |
CVE-2018-3818 | Medium | 6.1 | 2018-03-30 | Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow an attacker to obtain… |
CVE-2018-3817 | Medium | 6.5 | 2018-03-30 | When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive information. |
CVE-2015-5377 | Critical | 9.8 | 2018-03-06 | Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to cl… |
CVE-2017-11482 | Medium | 6.1 | 2017-12-08 | The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redirect vulnerability… |
CVE-2017-11481 | Medium | 6.1 | 2017-12-08 | Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtain sensitive informa… |
CVE-2017-11480 | High | 7.5 | 2017-12-08 | Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. If Packetbeat is listening for PostgreSQL traff… |
CVE-2017-8448 | High | 8.8 | 2017-09-29 | An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could create a watch that resu… |
CVE-2017-8447 | Medium | 6.5 | 2017-09-29 | An error was found in the X-Pack Security 5.3.0 to 5.5.2 privilege enforcement. If a user has either 'delete' or 'index' permissions on an index in a cluster… |
CVE-2017-8444 | Medium | 5.9 | 2017-09-29 | The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper. If an attacker is able to man in the mid… |
CVE-2017-11479 | Medium | 6.1 | 2017-09-29 | Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive information from or… |
CVE-2017-8446 | Medium | 5.3 | 2017-08-18 | The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability… |
CVE-2017-8445 | Medium | 5.5 | 2017-08-18 | An error was found in the X-Pack Security TLS trust manager for versions 5.0.0 to 5.5.1. If reloading the trust material fails the trust manager will be replac… |
CVE-2015-5619 | Medium | 5.9 | 2017-08-09 | Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash se… |
CVE-2017-8442 | Medium | 6.5 | 2017-07-07 | Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, su… |
CVE-2017-8443 | Medium | 6.5 | 2017-06-30 | In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kiban… |
CVE-2015-5378 | High | 7.5 | 2017-06-27 | Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read communications between Logstash Forwarder agent and Logstash server. |
CVE-2017-8452 | High | 7.5 | 2017-06-16 | Kibana versions prior to 5.2.1 configured for SSL client access, file descriptors will fail to be cleaned up after certain requests and will accumulate over ti… |
CVE-2017-8451 | Medium | 6.1 | 2017-06-16 | With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that re… |
CVE-2017-8450 | High | 7.5 | 2017-06-16 | X-Pack 5.1.1 did not properly apply document and field level security to multi-search and multi-get requests so users without access to a document and/or field… |
CVE-2017-8449 | Medium | 5.9 | 2017-06-16 | X-Pack Security 5.2.x would allow access to more fields than the user should have seen if the field level security rules used a mix of grant and exclude rules… |
CVE-2016-10366 | Medium | 6.1 | 2017-06-16 | Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack. |
CVE-2016-10365 | Medium | 6.1 | 2017-06-16 | Kibana versions before 4.6.3 and 5.0.1 have an open redirect vulnerability that would enable an attacker to craft a link in the Kibana domain that redirects to… |
CVE-2016-10364 | Medium | 6.5 | 2017-06-16 | With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authentica… |
CVE-2016-10363 | High | 7.5 | 2017-06-16 | Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5, Netflow v9 or IPFIX packets could perfo… |
CVE-2016-10362 | Medium | 6.5 | 2017-06-16 | Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials. |
CVE-2016-1000222 | High | 7.5 | 2017-06-16 | Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data. |
CVE-2016-1000221 | High | 7.5 | 2017-06-16 | Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information. |
CVE-2016-1000220 | Medium | 6.1 | 2017-06-16 | Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers. |
CVE-2016-1000219 | High | 7.5 | 2017-06-16 | Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This inf… |
CVE-2016-1000218 | High | 8.8 | 2017-06-16 | Kibana Reporting plugin version 2.4.0 is vulnerable to a CSRF vulnerability that could allow an attacker to generate superfluous reports whenever an authentica… |
CVE-2015-9056 | Medium | 6.1 | 2017-06-16 | Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a XSS attack. |
CVE-2017-8441 | Medium | 4.3 | 2017-06-05 | Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user… |
CVE-2017-8440 | Medium | 6.1 | 2017-06-05 | Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive informat… |
CVE-2017-8439 | Medium | 6.1 | 2017-06-05 | Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive i… |
CVE-2017-8438 | High | 8.8 | 2017-06-05 | Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitioning into the specif… |
CVE-2015-8131 | | 2015-12-07 | Cross-site request forgery (CSRF) vulnerability in Elasticsearch Kibana before 4.1.3 and 4.2.x before 4.2.1 allows remote attackers to hijack the authenticatio… | |
CVE-2015-4152 | | 2015-06-15 | Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vect… | |
CVE-2015-4093 | | 2015-06-15 | Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecifie… | |
CVE-2015-1427 | Critical | 9.8 | 2015-02-17 | The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute… |
CVE-2014-3120 | High | 8.1 | 2014-07-28 | The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java c… |
CVE-2014-4326 | | 2014-07-22 | Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagi… |