Elastic Kibana 安全漏洞

Elastic Kibana is an available data visualization dashboard software from Elastic, Inc. A security vulnerability exists in Elastic Kibana versions 8.15.0 through 8.17.1 and 8.17.1 through 8.17.2, which stems from prototype contamination that could lead to the execution of arbitrary code...

AWS VDP: Non-Production API Endpoints for the DocumentDB Elastic Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

The DocumentDB Elastic service was found to have three non-production API endpoints that could be accessed using standard IAM credentials without logging to CloudTrail. This allowed for silent permission enumeration, where an adversary could determine the permissions of compromised credentials...

Malicious code in elastic-buildkite-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 889d976fe581d0e221dc91fb52cc010669d68189ba293e437a6966b6decd515f The OpenSSF Package Analysis project identified 'elastic-buildkite-manager' @ 2.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2025-1469 Malicious code in elastic-buildkite-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 889d976fe581d0e221dc91fb52cc010669d68189ba293e437a6966b6decd515f The OpenSSF Package Analysis project identified 'elastic-buildkite-manager' @ 2.0.0 npm as malicious. It is considered malicious because: - The...

The vulnerability of the Elastic Defend software’s detection, monitoring, and response mechanisms is related to insufficient handling of exceptional states, allowing attackers to trigger a service failure.

The vulnerability of the software for detecting, monitoring, and responding to Elastic Defend threats is related to insufficient handling of exceptional states. Exploiting this vulnerability can allow attackers to cause service failures...

SUSE-SU-2025:20123-1 Security update for cloud-regionsrv-client

This update for cloud-regionsrv-client contains the following fixes: - Update to 10.3.11 bsc1234050 + Send registration code for the extensions, not only base product - Update to 10.3.9: bsc1234050 + Send registration code for the extensions, not only base product - Update to 10.3.8: bsc1233333 +...

SUSE CVE-2025-24884

kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16...

The vulnerability of the server software for managing Elastic Agent agents, known as Elastic Fleet Server, stems from deficiencies in access control. This allows a malicious individual to disclose sensitive information that is protected by this system.

The vulnerability of the server software for managing Elastic Agent agents in Elastic Fleet Server is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

PT-2025-5591 · Unknown +1 · Kube-Audit-Rest +1

Name of the Vulnerable Software and Affected Versions: kube-audit-rest versions prior to 1.0.16 Description: The issue concerns a simple logger of mutation/creation requests to the k8s API, where the previous values of Kubernetes secrets would have been disclosed in the audit messages if the...

kube-audit-rest 安全漏洞

kube-audit-rest is a Kubernetes audit logging by Richard Tweed Personal Developer. A security vulnerability exists in kube-audit-rest versions prior to 1.0.16, which stems from the fact that previous values of kubernetes secrets are leaked in audit messages if the full-elastic-stack example vecto...

CVE-2025-24884: Exposure of Sensitive Information to an Unauthorized Actor

kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16...

Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to Elastic Elasticsearch denial of service vulnerabilitiy.( CVE-2024-23450)

Summary Potential Elastic Elasticsearch denial of service vulnerabilitiy. CVE-2024-23450 has been identified that may affect IBM Watson CP4D Data Stores. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-23450 DESCRIPTION:...

Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to Elastic Elasticsearch sensitive information disclosure vulnerabilitiy( CVE-2024-23451)

Summary Potential Elastic Elasticsearch sensitive information disclosure vulnerabilitiy CVE-2024-23451 has been identified that may affect IBM Watson CP4D Data Stores. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-23451...

Security Bulletin: Vulnerability in Elastic Elasticsearch ( CVE-2024-23444) may affect IBM watsonx Assistant for IBM Cloud Pak for Data

Summary A potential sensitive information disclosure vulnerability CVE-2024-23444 has been identified related to Elastic Elasticsearch that may affect IBM watsonx Assistant for IBM Cloud Pak for Data. This vulnerability have been addressed. Refer to details for additional information. Vulnerabili...

Security Bulletin: Vulnerability in Elastic Elasticsearch ( CVE-2024-23444) affects IBM Watson CP4D Data Stores

Summary A potential information disclosure vulnerability CVE-2024-23444 has been identified related to Elastic Elasticsearch that affects IBM Watson CP4D Data Stores. This vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-23444...

BIT-KIBANA-2024-43707 Kibana exposure of sensitive information to an unauthorized actor

An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions...

BIT-ELK-2024-43707 Kibana exposure of sensitive information to an unauthorized actor

An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions...

CVE-2024-43707

An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions...

CVE-2024-43707 Kibana exposure of sensitive information to an unauthorized actor

An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions...

CVE-2024-43707 Kibana exposure of sensitive information to an unauthorized actor

An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions...