2245 matches found
Elasticsearch 8.5.3 Stack Overflow
Exploit Author: TOUHAMI KASBAOUI Vendor Homepage: https://elastic.co/ Version: 8.5.3 / OpenSearch Tested on: Ubuntu 20.04 LTS CVE : CVE-2023-31419 Ref: https://github.com/sqrtZeroKnowledge/Elasticsearch-Exploit-CVE-2023-31419 import requests import random import string esurl =...
The vulnerability of the _search component of the Elasticsearch search engine allows a hacker to trigger a service failure.
The vulnerability of the search component of the Elasticsearch search engine involves reading data beyond the buffer limits in memory. Exploiting this vulnerability can allow a malicious actor to cause a service failure by sending a specially crafted API request remotely...
Vulnerability fixed in Elastic ElasticSearch
Elastic has fixed a vulnerability in ElasticSearch. A malicious party could exploit the vulnerability to cause a denial-of-service attack. Elastic has released updates to fix the vulnerability in ElasticSearch 7.17.13 and 8.9.1. For more information, see: https://discuss.elastic.co/t...
Elasticsearch 8.9.1 / 7.17.13 Security Update
Elasticsearch StackOverflow vulnerability ESA-2023-14 A flaw was discovered in Elasticsearch, affecting the search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. Affected Versions: Elasticsearch versions from 7.0.0 to 7.17.12 and fr...
PT-2023-5274 · Elastic · Elasticsearch
Name of the Vulnerable Software and Affected Versions: Elasticsearch affected versions not specified Description: A flaw was discovered in Elasticsearch, affecting the search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. The...
Elasticsearch Security Statement regarding CVE-2022-1471
Elasticsearch is not affected by this issue. Elasticsearch is not affected by the issue described in CVE-2022-1471 as, in general, it does not use Snakeyaml to parse YAML. Summary Elasticsearch supports YAML as a format for search queries, and it also uses YAML for its configuration files i.e...
CVE-2023-31417
A flaw was found in the Elasticsearch package. Elasticsearch filters out sensitive information and credentials before logging into the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. As a result, sensitive informatio...
Metasploit Weekly Wrap-Up
New module content 4 Roundcube TimeZone Authenticated File Disclosure Authors: joel, stonepresto, and thomascube Type: Auxiliary Pull request: 18286 contributed by cudalac Path: auxiliary/gather/roundcubeauthfileread AttackerKB reference: CVE-2017-16651 Description: This PR adds a module to...
Elasticsearch Memory Disclosure
This module exploits a memory disclosure vulnerability in Elasticsearch 7.10.0 to 7.13.3 inclusive. A user with the ability to submit arbitrary queries to Elasticsearch can generate an error message containing previously used portions of a data buffer. This buffer could contain sensitive...
Metasploit Weekly Wrap-Up
Pumpkin Spice Modules Here in the northern hemisphere, fall is on the way: leaves changing, the air growing crisp and cool, and some hackers changing the flavor of their caffeine. This release features a new exploit module targeting Apache NiFi as well as a new and improved library to interact wi...
Malicious code in mmolecule-elasticsearch (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4066df1016d7aee5ec19b765089b99b9b47513327cbbe8afe20985bb3fbda37b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-7968 Malicious code in mmolecule-elasticsearch (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4066df1016d7aee5ec19b765089b99b9b47513327cbbe8afe20985bb3fbda37b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Elasticsearch Enumeration Utility
This module enumerates Elasticsearch instances. It uses the REST API in order to gather information about the server, the cluster, nodes, in the cluster, indices, and pull data from those indices. Module Options msf use auxiliary/gather/elasticsearchenum msf auxiliaryelasticsearchenum show action...
Information Exposure
Overview logstash-core is a scalable log and event management tool. Affected versions of this package are vulnerable to Information Exposure. Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information. Remediation Upgrade logstash-core to...
GHSA-HR8G-6V94-X4M9 vulnerabilities
Vulnerabilities for packages: elasticsearch, druid, tez, gradle...
CVE-2023-33201 vulnerabilities
Vulnerabilities for packages: elasticsearch, druid, tez, gradle...
Vulnerability fixed in Elasticsearch
Elastic has fixed a vulnerability in Elasticsearch. A malicious party could exploit the vulnerability to cause a denial-of-service attack. Elastic has released updates to fix the vulnerability in Elasticsearch 8.8.2 and 7.17.11. For more information, see: https://discuss.elastic.co/t...
GHSA-7G45-4RM6-3MM3 vulnerabilities
Vulnerabilities for packages: cassandra-reaper, trino, maven-stage0, spark-fips, spdx-tools-java, gradle, hadoop-fips, hadoop-client-modules, celeborn...