GHSA-JJQ8-VFJQ-J6V4 Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls...

Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls...

GHSA-8QHQ-RQ4J-8PRJ Elasticsearch Logstash allows remote attackers to execute arbitrary commands

Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in 1 zabbix.rb or 2 nagiosnsca.rb in outputs/...

Elasticsearch Logstash allows remote attackers to execute arbitrary commands

Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in 1 zabbix.rb or 2 nagiosnsca.rb in outputs/...

GHSA-VCMM-PPQX-95CH Logstash Logs Sensitive Information

Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information...

Logstash Logs Sensitive Information

Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information...

Elasticsearch Logstash allows remote attackers to execute arbitrary commands

Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in 1 zabbix.rb or 2 nagiosnsca.rb in outputs/...

Elasticsearch Logstash allows remote attackers to execute arbitrary commands

Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in 1 zabbix.rb or 2 nagiosnsca.rb in outputs/...

Logstash Logs Sensitive Information

Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials...

GHSA-3GG4-6HQG-2VJX Logstash Logs Sensitive Information

Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials...

com.aconex.scrutineer:scrutineer (=6.5.0), com.automattic:elasticsearch-statsd (>=6.5.0.0 <=6.5.1.0) +35 more potentially affected by CVE-2018-17247 via org.elasticsearch:elasticsearch (>=6.5.0 <=6.5.1)

org.elasticsearch:elasticsearch MAVEN version =6.5.0, =6.5.0.0, =6.5.1-32.2, =6.5.1-23.2, =6.5.1-25.5, =1.1.0, =1.1.0, =1.0, =6.5.0.0, =0.3.3, =5.4.2.1.RELEASE, =5.4.2.1.RELEASE, =5.4.2.1.RELEASE, =5.4.2.1.RELEASE, =6.5.1.7.RELEASE and more Source cves: CVE-2018-17247 Source advisory:...

com.alessandromarrella:fs2-elastic_2.12 (>=6.4.0 <=6.4.1), com.automattic:elasticsearch-statsd (>=6.4.0.0 <=6.4.2.0) +64 more potentially affected by CVE-2018-17244 via org.elasticsearch:elasticsearch (>=6.4.0 <=6.4.2)

org.elasticsearch:elasticsearch MAVEN version =6.4.0, =6.4.0, =6.4.0.0, =0.0.4, =6.4.0-32.0, =6.4.0-23.0, =6.4.0-25.4, =0.0.2, =1.0.0, =1.0.0, =183, =4.2, =4.4 - com.sksamuel.elastic4s:elastic4s-embedded2.11 =6.4.0 and more Source cves: CVE-2018-17244 Source advisory: OSV:GHSA-VPQM-88C4-X4CV...

GHSA-VPQM-88C4-X4CV Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; wh...

Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; wh...

GHSA-CCMR-QJ26-845G Improper Restriction of XML External Entity Reference in Elasticsearch

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's findfilestructure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content ...

Improper Restriction of XML External Entity Reference in Elasticsearch

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's findfilestructure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content ...

ai.grakn:grakn-dist (>=0.7.0 <=0.16.0), ai.grakn:grakn-test (=0.10.0) +1399 more potentially affected by CVE-2018-3824 via org.elasticsearch:elasticsearch (>=0.6.0 <=5.6.8)

org.elasticsearch:elasticsearch MAVEN version =0.6.0, =0.7.0, =0.6.1, =0.11.0, =0.3.0, =1.0.1, =1.0.0, =1.0.0-RELEASE, =1.1.0, =1.0.0, =1.1.0, =1.0.0, =1.4.0 and more Source cves: CVE-2018-3824 Source advisory: OSV:GHSA-MJPC-QX7H-R8C9...

ch.squaredesk.nova:metrics-elastic (>=4.0.0-beta-1 <=7.0.2), co.luminositylabs.oss.ica.migration:elasticsearch-loader (=0.2.0) +137 more potentially affected by CVE-2018-3824 via org.elasticsearch:elasticsearch (>=6.0.0 <=6.2.3)

org.elasticsearch:elasticsearch MAVEN version =6.0.0, =4.0.0-beta-1, =6.0.0, =6.1.1.0, =0.1.0-RC9, =5.0.3.9.6, =1.0, =1.2.0-2-ES6.0.0, =1.27.0, =0.217, =0.219, =6.0-7.beta1, =6.0-21.1 and more Source cves: CVE-2018-3824 Source advisory: OSV:GHSA-MJPC-QX7H-R8C9...

GHSA-MJPC-QX7H-R8C9 Elasticsearch subject to cross site scripting

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting XSS vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive...

Elasticsearch subject to cross site scripting

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting XSS vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive...