CVE-2021-22140

Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue XXE in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of t...

Xxe

Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue XXE in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of t...

CVE-2021-22140

Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue XXE in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of t...

CVE-2021-22140

Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue XXE in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of t...

CVE-2021-22140

Elastic App Search (web crawler beta) versions 7.11.0–7.12.0 are affected by an XML External Entity (XXE) injection in the crawler, allowing an attacker crawling the site via a manipulated sitemap.xml to read files on the host. Root cause: insufficient validation of XML in the crawler. Impact: po...

Unbreakable Enterprise kernel-container security update

4.14.35-2047.503.1.el7 - bpf, x86: Validate computation of branch displacements for x86-64 Piotr Krysiuk Orabug: 32759961 CVE-2021-29154 - uek-rpm: Add Amazon Elastic Network Adapter module to nano rpm. Somasundaram Krishnasamy Orabug: 32781585 - ext4: handle error of ext4setupsystemzone on remou...

CVE-2021-22140

A flaw was found in Elastic Enterprise Search. An attacker, using an XML External Entity Injection XXE issue in the App Search web crawler, could craft a malicious sitemap.xml allowing the crawler to traverse the filesystem of the host running the instance and obtain sensitive files. The highest...

Elastic Stack Kibana 资源管理错误漏洞

Elastic Stack Kibana is an application from Elastic Stack USA. A free and open user interface that enables you to visualize Elasticsearch data and lets you navigate within Elastic Stack. A resource management error vulnerability exists in Kibana that stems from a lack of a timeout or a limit on t...

Elastic App Search web crawler 代码问题漏洞

Elastic App Search web crawler is an application from Elastic USA. provides greater scalability and performance enhancements. A code issue vulnerability exists in App Search web crawler that stems from insufficient validation of user-supplied XML input in Enterprise Search. The following products...

CVE-2021-22997

On all 7.x and 6.x versions fixed in 8.0.0, BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development...

Elastic EpiServer Find 输入验证错误漏洞

Elastic EpiServer Find is an open source application from Elastic. A search engine that enables developers to build great search experiences on websites , Intranet and almost any type of system with text content . An arbitrary redirection vulnerability in EpiServer Find versions prior to 13.2.7 c...

IBM Elastic Storage System Denial of Service Vulnerability (CNVD-2021-26383)

IBM Elastic Storage System is an appliance for data management of large data volumes from IBM in the United States. A denial of service vulnerability exists in IBM Elastic Storage System, which can be exploited by an attacker to deny service by sending a malformed UDP request...

Security Bulletin: A vulnerability has been identified in IBM Elastic Storage System where an attacker could cause a denial of service (CVE-2020-4382)

Summary A security vulnerability has been identified in all levels of IBM Elastic Storage System that could allow an attacker to cause a denial of service. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4382 DESCRIPTION: IBM Spectrum Scale for IBM Elastic Storage...

CVE-2020-5015

IBM Elastic Storage System 6.0.0 through 6.0.1.2 and IBM Elastic Storage Server 5.3.0 through 5.3.6.2 could allow a remote attacker to cause a denial of service by sending malformed UDP requests. IBM X-Force ID: 193486...

Code injection

IBM Elastic Storage System 6.0.0 through 6.0.1.2 and IBM Elastic Storage Server 5.3.0 through 5.3.6.2 could allow a remote attacker to cause a denial of service by sending malformed UDP requests. IBM X-Force ID: 193486...

CVE-2021-22133

A flaw was found in the Elastic APM agent for Go in several versions, where it can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server...

CVE-2020-5015

IBM Elastic Storage System 6.0.0 through 6.0.1.2 and IBM Elastic Storage Server 5.3.0 through 5.3.6.2 could allow a remote attacker to cause a denial of service by sending malformed UDP requests. IBM X-Force ID: 193486...

CVE-2020-5015

CVE-2020-5015 affects IBM Elastic Storage System (ESS) 6.0.0–6.0.1.2 and IBM Elastic Storage Server (ESS) 5.3.0–5.3.6.2, enabling a remote attacker to cause a denial of service by sending malformed UDP requests. Root cause details in connected files indicate an UDP-based DoS vector. Impact per so...

Security Bulletin: A vulnerability in IBM Java SE affects IBM Elastic Storage Server

Summary There is a vulnerability in IBM SDK Java Technology Edition, used by IBM Elastic Storage Server. This issue was disclosed as part of the IBM Java SDK updates in Oct 2020. Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability in Java SE related to the...

Security Bulletin: A vulnerability in IBM® SDK, Java™ Technology Edition affects IBM Elastic Storage Server

Summary A vulnerability in IBM® SDK, Java™ Technology Edition, used by IBM Elastic Storage Server. This issue was disclosed as part of the IBM Java SDK updates in Jan 2021. Vulnerability Details CVEID: CVE-2020-27221 DESCRIPTION: Eclipse OpenJ9 is vulnerable to a stack-based buffer overflow when...