83 matches found
GHSA-X83W-23JP-G6PW OpenSearch Security plugin: DLS not applied on documents linked by has_child or has_parent relation
Description A flaw was identified in the OpenSearch Security plugin's document-level security DLS implementation. DLS restrictions were not correctly applied to search queries that use hasparent or haschild join relations. This could allow an authenticated user to access document contents that...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of search queries involving hasparent or haschild join relations when document-level security is enabled. An attacker can gain unauthorized access to restricted document contents by crafting...
OpenSearch Security plugin: DLS not applied on documents linked by has_child or has_parent relation
Description A flaw was identified in the OpenSearch Security plugin's document-level security DLS implementation. DLS restrictions were not correctly applied to search queries that use hasparent or haschild join relations. This could allow an authenticated user to access document contents that...
PT-2026-41510
Name of the Vulnerable Software and Affected Versions OpenSearch versions prior to 2.19.4 OpenSearch versions prior to 3.2.0 Description A flaw exists in the OpenSearch Security plugin's document-level security DLS implementation. DLS restrictions are not correctly applied to search queries...
CVE-2025-12149
In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security DLS is correctly enforced elsewhere, when the search is triggered from a Signals watch, the DLS rule is not enforced, allowing access to all documents in the queried indices...
CVE-2025-12149
In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security DLS is correctly enforced elsewhere, when the search is triggered from a Signals watch, the DLS rule is not enforced, allowing access to all documents in the queried indices...
CVE-2025-12149
In CVE-2025-12149, Search Guard FLX ≤3.1.2 fails to enforce Document-Level Security when a Signals-watch triggers a search, potentially allowing access to all documents in the queried indices. Affected component: Search Guard FLX; root cause: DLS enforcement gap specific to Signals-triggered sear...
CVE-2025-12149 Unauthorized access to documents protected by Document-Level Security (DLS), when Signals watches include a search query involving protected documents
In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security DLS is correctly enforced elsewhere, when the search is triggered from a Signals watch, the DLS rule is not enforced, allowing access to all documents in the queried indices...
EUVD-2025-197609
In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security DLS is correctly enforced elsewhere, when the search is triggered from a Signals watch, the DLS rule is not enforced, allowing access to all documents in the queried indices...
CVE-2025-12149 Unauthorized access to documents protected by Document-Level Security (DLS), when Signals watches include a search query involving protected documents
In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security DLS is correctly enforced elsewhere, when the search is triggered from a Signals watch, the DLS rule is not enforced, allowing access to all documents in the queried indices...
PT-2025-46956
Name of the Vulnerable Software and Affected Versions Search Guard FLX versions 3.1.2 and earlier Description In Search Guard FLX versions 3.1.2 and earlier, Document-Level Security DLS is not enforced when a search is initiated from a Signals watch, potentially granting access to all documents...
EUVD-2017-17392
Malware in sbrugna...
EUVD-2021-1968
Malware in sbrugna...
EUVD-2016-7276
Malware in sbrugna...
EUVD-2023-1133
Malicious code in bioql PyPI...
EUVD-2024-20949
Malicious code in bioql PyPI...
EUVD-2023-50857
Malicious code in bioql PyPI...
EUVD-2022-3790
Malicious code in bioql PyPI...
EUVD-2024-20950
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2024-12539
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security ...