1833 matches found
CVE-2019-7617
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...
CVE-2019-7617
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...
PYSEC-2019-178
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...
Design/Logic Flaw
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...
apm-agent-utils (>=1.0.3 <=1.3.0), enochecker (>=0.0.5 <=0.0.9) +1 more potentially affected by CVE-2019-7617 via elastic-apm (>=4.2.2 <=5.10.1)
elastic-apm PYPI version =4.2.2, =1.0.3, =0.0.5, =0.0.14, =0.0.24.post2 Source cves: CVE-2019-7617 Source advisory: OSV:PYSEC-2019-178...
PYSEC-2019-178
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...
CVE-2019-7617
Elastic APM for Python versions before 5.1.0 is affected when run as a CGI script. A variable name clash occurs if an attacker can control the proxy header, potentially redirecting collected APM data to a proxy of their choosing. Impact described is data redirection/exfiltration. Recommended reme...
CVE-2019-7617
When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing...
Elastic APM agent for Python 5.1.0 security update
Elastic APM agent for Python client CGI proxy redirection flaw ESA-2019-11 When the Elastic APM agent for Python is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a prox...
Firmware Slap - Discovering Vulnerabilities In Firmware Through Concolic Analysis And Function Clustering
Firmware slap combines concolic analysis with function clustering for vulnerability discovery and function similarity in firmware. Firmware slap is built as a series of libraries and exports most information as either pickles or JSON for integration with other tools. Slides from the talk can be...
Elastic Kibana < 6.8.2, 7.x < 7.2.1 Multiple Vulnerabilities (ESA-2019-09, ESA-2019-10) - Windows
Kibana is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Elastic Kibana < 6.8.2, 7.x < 7.2.1 Multiple Vulnerabilities (ESA-2019-09, ESA-2019-10) - Linux
Kibana is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2019-7885
Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure th...
CVE-2019-7885
Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure th...
CVE-2019-7885
CVE-2019-7885 affects Magento: insufficient input validation in the Elastic Search module config builder allows authenticated users with catalog search config rights to trigger remote code execution. Impact is described as RCE in Magento 2.1 (<2.1.18), 2.2 (<2.2.9), and 2.3 (
CloudBees Jenkins Amazon EC2 Plugin Information Disclosure Vulnerability
CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Amazon EC2 Plugin is used in which an EC2 connection agen...
CVE-2019-10364
Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log...
Man-in-the-Middle (MitM)
elastic-apm is vulnerable to man-in-the-middle MitM attacks. When specifying a trusted server CA certificate via the servercacert setting, a TLS certificate validation error causes improper verification of the certificate returned by the APM server. This allows an attacker to perform...
PT-2019-11760 · Jenkins · Jenkins Amazon Ec2 Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Amazon EC2 Plugin versions 1.43 and earlier Description: The issue concerns the Jenkins Amazon EC2 Plugin, which wrote the beginning of private keys to the Jenkins system log. This could potentially expose sensitive information. The...
CVE-2019-7615
A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the 'servercacert' setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the...