Elastic Stack 6.2.3 security update

X-Pack Security SAML vulnerability ESA-2018-07 X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect XML canonicalization and DOM traversal. An attacker might have been able to impersonate a legitimate user if the SAML Identity Provider allow...

eve-elastic (=2.6.0), eve-sqlalchemy (>=0.5.0 <=0.7.1) +1 more potentially affected by CVE-2018-8097 via eve (>=0.6.4 <=0.7.10)

eve PYPI version =0.6.4, =0.5.0, =1.0.0, =1.4.0rc2 Source cves: CVE-2018-8097 Source advisory: OSV:PYSEC-2018-8...

Elastic Kibana End of Life (EOL) Detection

The Elastic Kibana version on the remote host has reached the End of Life EOL and should not be used anymore. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier...

Important: Red Hat Security Advisory: jboss-ec2-eap package for EAP 7.1.1

An update for eap7-jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 7.1.1 for Red Hat Enterprise Linux 6 and Red Hat JBoss Enterprise Application Platform 7.1.1 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impa...

Elastic Kibana 'CVE-2017-11499' DoS Vulnerability - Windows

Elastic Kibana is shipping a version of Node.js which is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Elastic Kibana 'CVE-2017-11499' DoS Vulnerability - Linux

Elastic Kibana is shipping a version of Node.js which is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Elastic Kibana Reporting plugin 'CVE-2016-1000218' CSRF Vulnerability

Version 2.4.0 of the Reporting plugin for Elastic Kibana is vulnerable to a CSRF vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Elastic Logstash 'CVE-2016-10362' Information Disclosure Vulnerability

Elastic Logstash is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

The vulnerability of the authentication function of the Cisco Elastic Services Controller’s virtualization environment for network functions allows a perpetrator to bypass the authentication process and obtain administrator privileges.

The vulnerability of the authentication function of the Cisco Elastic Services Controller ESC web portal for virtualizing network functions is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to bypass the authentication process an...

Elastic Logstash 'CVE-2016-1000221' Information Disclosure Vulnerability

Elastic Logstash is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Elastic Logstash 'CVE-2016-10363' DoS Vulnerability

Elastic Logstash is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Elastic Logstash 'CVE-2018-3817' Information Disclosure Vulnerability

Elastic Logstash is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Elastic Logstash 'CVE-2016-1000222' Malicious Input Vulnerability

Elastic Logstash is prone to a vulnerability related to malicious input. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cisco Elastic Services Controller Software Unauthorized Access Vulnerability

Cisco Elastic Services Controller Software ESC is the United States Cisco Cisco company's set of open source for the management of virtual resources modular system. service portal is one of the Web-based business system portal. An unauthorized vulnerability exists in the use of JSON Web tokens in...

Cisco Elastic Services Controller Software Authentication Bypass Vulnerability

Cisco Elastic Services Controller Software ESC is the U.S. Cisco Cisco, a set of open source for the management of virtual resources modular system. An authentication bypass vulnerability exists in the authentication feature of the Web-based business portal in Cisco Elastic ESC version 3.0.0, whi...

Default credentials

A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials f...

CVE-2018-0130

A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials f...

CVE-2018-0121

A vulnerability in the authentication functionality of the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The...

Authentication flaw

A vulnerability in the authentication functionality of the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The...

CVE-2018-0130

A vulnerability in the use of JSON web tokens by the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to gain administrative access to an affected system. The vulnerability is due to the presence of static default credentials f...