CVE-2023-45807 OpenSearch Issue with tenant read-only permissions

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: hey, secrets-store-csi-driver, prometheus-pushgateway-fips, helm, node-problem-detector, chartmuseum, kubescape, dynamic-localpv-provisioner-fips, gke-gcloud-auth-plugin, smarter-device-manager-fips, kaf, k3s, kube-state-metrics-fips, kubernetes-csi-livenessprobe,...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: flux-source-controller, kubescape, oauth2-proxy, wireguard-go, kubernetes-ingress-defaultbackend, prometheus-alertmanager, kaf, aws-load-balancer-controller, timoni, src, crossplane-provider-aws, kots, frp, mc, secrets-store-csi-driver, vertical-pod-autoscaler,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: hey, secrets-store-csi-driver, prometheus-pushgateway-fips, helm, node-problem-detector, chartmuseum, kubescape, dynamic-localpv-provisioner-fips, gke-gcloud-auth-plugin, smarter-device-manager-fips, kaf, k3s, kube-state-metrics-fips, kubernetes-csi-livenessprobe,...

GHSA-XPW8-RCWV-8F8P vulnerabilities

Vulnerabilities for packages: trino, wavefront-proxy, cloudwatch-exporter...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: flux-source-controller, kubescape, oauth2-proxy, terraform-provider-aws, ko, wireguard-go, kaf, src, ip-masq-agent, frp, kots, mc, secrets-store-csi-driver, metacontroller, nginx-mainline, minio, nri-prometheus, prometheus-adapter, grpcurl, helm, scorecard,...

The vulnerability of the Elasticsearch search system in the Cisco Catalyst SD-WAN Manager (formerly Cisco SD-WAN vManage) centralized network management system allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Elasticsearch search system in the Cisco Catalyst SD-WAN Manager formerly Cisco SD-WAN vManage centralized network management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protecte...

GHSA-57M8-F3V5-HM5M vulnerabilities

Vulnerabilities for packages: elasticsearch, keycloak, wavefront-proxy...

CVE-2023-4586 vulnerabilities

Vulnerabilities for packages: elasticsearch, keycloak, wavefront-proxy...

CVE-2023-20034

Vulnerability in the Elasticsearch database used in the of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to access the Elasticsearch configuration database of an affected device with the privileges of the elasticsearch user. These vulnerability is due to the presen...

CVE-2023-20034

Vulnerability in the Elasticsearch database used in the of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to access the Elasticsearch configuration database of an affected device with the privileges of the elasticsearch user. These vulnerability is due to the presen...

Design/Logic Flaw

Vulnerability in the Elasticsearch database used in the of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to access the Elasticsearch configuration database of an affected device with the privileges of the elasticsearch user. These vulnerability is due to the presen...

CVE-2023-20034

CVE-2023-20034 affects Cisco SD-WAN vManage (Elasticsearch component). The issue arises from a static username/password configured on vManage, enabling an unauthenticated, remote attacker to access the Elasticsearch configuration database and view its content by sending a crafted HTTP request to ...

CVE-2023-20034

Vulnerability in the Elasticsearch database used in the of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to access the Elasticsearch configuration database of an affected device with the privileges of the elasticsearch user. These vulnerability is due to the presen...

PT-2023-5690 · Cisco · Cisco Sd-Wan Vmanage

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage affected versions not specified Description: The issue is related to insufficient access controls in the Elasticsearch database used by Cisco SD-WAN vManage software. This could allow an unauthenticated, remote attacker t...

Cisco SD-WAN vManage Security Vulnerability

Cisco SD-WAN vManage is a highly customizable dashboard from Cisco, Inc. that simplifies and automates the deployment, configuration, management, and operation of Cisco SD-WAN. A security vulnerability exists in Cisco SD-WAN vManage that originates from an unauthenticated remote attacker accessin...

Elasticsearch 8.5.3 Stack Overflow Exploit

Exploit Author: TOUHAMI KASBAOUI Vendor Homepage: https://elastic.co/ Version: 8.5.3 / OpenSearch Tested on: Ubuntu 20.04 LTS CVE : CVE-2023-31419 Ref: https://github.com/sqrtZeroKnowledge/Elasticsearch-Exploit-CVE-2023-31419 import requests import random import string esurl =...

Vulnerability fixed in Elastic ElasticSearch

Elastic has fixed a vulnerability in ElasticSearch. A unauthenticated malicious person could exploit the vulnerability to cause a denial-of-service. Elastic has released updates to fix the vulnerability in ElasticSearch 7.17.13 and 8.9.0. For more information, see: https://discuss.elastic.co/t...

Elasticsearch Buffer Error Vulnerability

Elasticsearch is a search engine based on the Lucene library. Elasticsearch suffers from a buffer error vulnerability that stems from the search API allowing specially crafted query strings to cause a stack overflow and ultimately a denial of service...

Elasticsearch 8.9.0, 7.17.13 Security Update

Elasticsearch uncontrolled resource consumption ESA-2023-13 An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP...