Elastic Defend 日志信息泄露漏洞

Elastic Defend is an application from the Dutch company Elastic. It provides prevention, detection and response capabilities, as well as deep visibility into EPP, EDR, SIEM and security analytics. A log information disclosure vulnerability exists in Elastic Defend versions prior to 8.17.3, which...

Elastic Kibana 资源管理错误漏洞

Elastic Kibana is an available data visualization dashboard software from Elastic, Inc. A resource management error vulnerability exists in Elastic Kibana versions 7.17.0 through 7.17.22 and 8.0.0 through 8.15.0, which stems from a flaw in the handling of ad-hoc requests to the Observability API...

Elastic Kibana 安全漏洞

Elastic Kibana is a usable data visualization dashboard software from Elastic. A security vulnerability exists in Elastic Kibana versions 8.16.1 and earlier and 8.17.1, which stems from prototype contamination combined with unrestricted file uploads and path traversal, which could lead to code...

Citrix App Layering 2409 - Unable to Edit App Layers with Boot Error 0xc000000f

Administrators may encounter an issue where they are unable to edit Application Layers within Citrix Elastic Layer Management ELM version 2409 after applying the February 2025 patches to their Windows 11 24H2 packaging machines. This inability to edit App Layers is accompanied by aboot error code...

CVE-2024-10190 Unauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovod

Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the ElasticRendezvousHandler, a subclass of KVStoreHandler. Specifically, the putvalue method in ElasticRendezvousHandler...

CVE-2025-29786 vulnerabilities

Vulnerabilities for packages: keda, argo-rollouts-fips, opentelemetry-collector-fips, kargo, argo-cd-fips, opentelemetry-collector-contrib-fips, kubeflow-pipelines, splunk-otel-collector, splunk-otel-collector-fips, grafana-alloy-fips, eks-distro-fips, argo-cd, opentelemetry-collector-contrib,...

GHSA-93MQ-9FFX-83M2 vulnerabilities

Vulnerabilities for packages: keda, argo-rollouts-fips, opentelemetry-collector-fips, kargo, argo-cd-fips, opentelemetry-collector-contrib-fips, kubeflow-pipelines, splunk-otel-collector, splunk-otel-collector-fips, grafana-alloy-fips, eks-distro-fips, argo-cd, opentelemetry-collector-contrib,...

Elastic Releases Urgent Fix for Critical Kibana Vulnerability Enabling Remote Code Execution

Elastic has rolled out security updates to address a critical security flaw impacting the Kibana data visualization dashboard software for Elasticsearch that could result in arbitrary code execution. The vulnerability, tracked as CVE-2025-25015 , carries a CVSS score of 9.9 out of a maximum of...

CVE-2024-10925

A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Security policy YAML...

Elastic Kibana 安全漏洞

Elastic Kibana is an available data visualization dashboard software from Elastic, Inc. A security vulnerability exists in Elastic Kibana versions 8.15.0 through 8.17.1 and 8.17.1 through 8.17.2, which stems from prototype contamination that could lead to the execution of arbitrary code...

AWS VDP: Non-Production API Endpoints for the DocumentDB Elastic Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

The DocumentDB Elastic service was found to have three non-production API endpoints that could be accessed using standard IAM credentials without logging to CloudTrail. This allowed for silent permission enumeration, where an adversary could determine the permissions of compromised credentials...

Malicious code in elastic-buildkite-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 889d976fe581d0e221dc91fb52cc010669d68189ba293e437a6966b6decd515f The OpenSSF Package Analysis project identified 'elastic-buildkite-manager' @ 2.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2025-1469 Malicious code in elastic-buildkite-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 889d976fe581d0e221dc91fb52cc010669d68189ba293e437a6966b6decd515f The OpenSSF Package Analysis project identified 'elastic-buildkite-manager' @ 2.0.0 npm as malicious. It is considered malicious because: - The...

The vulnerability of the Elastic Defend software’s detection, monitoring, and response mechanisms is related to insufficient handling of exceptional states, allowing attackers to trigger a service failure.

The vulnerability of the software for detecting, monitoring, and responding to Elastic Defend threats is related to insufficient handling of exceptional states. Exploiting this vulnerability can allow attackers to cause service failures...

SUSE-SU-2025:20123-1 Security update for cloud-regionsrv-client

This update for cloud-regionsrv-client contains the following fixes: - Update to 10.3.11 bsc1234050 + Send registration code for the extensions, not only base product - Update to 10.3.9: bsc1234050 + Send registration code for the extensions, not only base product - Update to 10.3.8: bsc1233333 +...

SUSE CVE-2025-24884

kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16...

The vulnerability of the server software for managing Elastic Agent agents, known as Elastic Fleet Server, stems from deficiencies in access control. This allows a malicious individual to disclose sensitive information that is protected by this system.

The vulnerability of the server software for managing Elastic Agent agents in Elastic Fleet Server is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

PT-2025-5591 · Unknown +1 · Kube-Audit-Rest +1

Name of the Vulnerable Software and Affected Versions: kube-audit-rest versions prior to 1.0.16 Description: The issue concerns a simple logger of mutation/creation requests to the k8s API, where the previous values of Kubernetes secrets would have been disclosed in the audit messages if the...

kube-audit-rest 安全漏洞

kube-audit-rest is a Kubernetes audit logging by Richard Tweed Personal Developer. A security vulnerability exists in kube-audit-rest versions prior to 1.0.16, which stems from the fact that previous values of kubernetes secrets are leaked in audit messages if the full-elastic-stack example vecto...

Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to Elastic Elasticsearch denial of service vulnerabilitiy.( CVE-2024-23450)

Summary Potential Elastic Elasticsearch denial of service vulnerabilitiy. CVE-2024-23450 has been identified that may affect IBM Watson CP4D Data Stores. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-23450 DESCRIPTION:...