Palo Alto Networks PAN-OS for Panorama < 9.0.15 / 9.1.12-h3 / 10.0.8-h8 Multiple RCE (Log4Shell)

The version of Palo Alto Networks PAN-OS for Panorama running on the remote host is 9.0.x prior to 9.0.15, 9.1.x prior to 9.1.12-h3, or 10.0.x prior to 10.0.8-h8. It is, therefore, affected by two remote code execution vulnerabilities related to Log4Shell within the ElasticSearch component. These...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Spectrum Archive Enterprise Edition (CVE-2021-44228)

Summary A vulnerability in Apache Log4j could allow an attacker to execute arbitrary code on the system. This vulnerability may affect the IBM Spectrum Archive Enterprise Edition EE. The below fix package includes Apache Log4j 2.15. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache...

Exposure of Sensitive Information to an Unauthorized Actor in sscarduzio/elasticsearch-readonlyrest-plugin

Description elasticsearch-readonlyrest-plugin is using TLS. There are many serious vulnerabilities in early TLS that left unaddressed put organizations at risk of being breached. The widespread POODLE and BEAST exploits are just a couple of examples of how attackers have taken advantage of...

Security Bulletin: Multiple vulnerabilities affect IBM Observability with Instana

Summary Vulnerabilities detected in Elasticsearch before versions 7.9.0 and 6.8.12 affects IBM Observability with Instana Vulnerability Details CVEID: CVE-2020-7019 DESCRIPTION: Elasticsearch could allow a remote authenticated attacker to obtain sensitive information, caused by a field disclosure...

Security Bulletin: Multiple vulnerabilities affect IBM Observability with Instana

Summary Vulnerabilities detected in Elasticsearch versions before 7.2.1 and 6.8.2 affects IBM Observability with Instana Vulnerability Details CVEID: CVE-2019-7614 DESCRIPTION: Elastic Elasticsearch could allow a remote authenticated attacker to obtain sensitive information, caused by a race...

Security Bulletin: Multiple vulnerabilities affect IBM Observability with Instana

Summary Vulnerabilities detected in Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.2 affects IBM Observability with Instana Vulnerability Details CVEID: CVE-2019-7619 DESCRIPTION: Elastic Elasticsearch could allow a remote attacker to obtain sensitive information, caused by a flaw in...

Security Bulletin: Vulnerability affects IBM Observability with Instana

Summary Vulnerability detected in Elasticsearch before version 7.10.2 affects IBM Observability with Instana Vulnerability Details CVEID: CVE-2021-22132 DESCRIPTION: Elastic Elasticsearch could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in the async...

Security Bulletin: Vulnerability affects IBM Observability with Instana

Summary Vulnerability detected in Elasticsearch versions before 7.10.0 and 6.8.14 affects IBM Observability with Instana Vulnerability Details CVEID: CVE-2020-7021 DESCRIPTION: Elasticsearch could allow a local authenticated attacker to obtain sensitive information, caused by an error when audit...

Security Bulletin: Vulnerabilitiy affects IBM Observability with Instana

Summary Vulnerabilities detected in Elasticsearch versions before 7.9.2 and 6.8.13 affects IBM Observability with Instana Vulnerability Details CVEID: CVE-2020-7020 DESCRIPTION: Elastic Enterprise Search could allow a remote authenticated attacker to obtain sensitive information, caused by not...

bower-cache (=0.5.0), cacahuate (>=3.9.0 <=4.0.0a6) +58 more potentially affected by CVE-2021-23727 via celery (>=3.1.11 <=5.2.1)

celery PYPI version =3.1.11, =3.9.0, =0.0.2, =1.0.1, =0.19.0, =2.0.0a0, =1.0.0, =1.0.24, =0.0.5, =0.0.13, =1.0.18, =1.2.7 and more Source cves: CVE-2021-23727 Source advisory: OSV:GHSA-Q4XR-RC97-M4XX...

Security Bulletin: IBM Cloud Pak for Multicloud Management has applied security fixes for its use of Log4j for CVE-2021-44228

Summary IBM Cloud Pak for Multicloud Management has applied security fixes for its use of Log4j for CVE-2021-44228. Log4j is used by various microservices either directly or indirectly through dependent open source software for logging messages to files. Vulnerability Details CVEID: CVE-2021-4422...

Security Bulletin: Vulnerability in Elasticsearch affects IBM Cloud Private (CVE-2021-22144)

Summary There is a vulnerability in the Elasticsearch open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Elasticsearch vulnerability CVE-2021-22144. Vulnerability Details CVEID: CVE-2021-22144 DESCRIPTION:...

Security Bulletin: Vulnerability in Elasticsearch affects IBM Cloud Private (CVE-2021-22138)

Summary There is a vulnerability in the Elasticsearch open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Elasticsearch vulnerability CVE-2021-22138. Vulnerability Details CVEID: CVE-2021-22138 DESCRIPTION:...

Security Bulletin: Vulnerability in Elasticsearch affects IBM Cloud Private (CVE-2021-22138)

Summary There is a vulnerability in the Elasticsearch open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Elasticsearch vulnerability CVE-2021-22138. Vulnerability Details CVEID: CVE-2021-22138 DESCRIPTION:...

Security Bulletin: Vulnerability in Elasticsearch affects IBM Cloud Private (CVE-2021-22135, CVE-2021-22137)

Summary There is a vulnerability in the Elasticsearch open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Elasticsearch vulnerability CVE-2021-22135, CVE-2021-22137. Vulnerability Details CVEID: CVE-2021-22135...

SyntheticSun - A Defense-In-Depth Security Automation And Monitoring Framework Which Utilizes Threat Intelligence, Machine Learning, Managed AWS Security Services And, Serverless Technologies To Continuously Prevent, Detect And Respond To Threats

SyntheticSun is a defense-in-depth security automation and monitoring framework which utilizes threat intelligence, machine learning, managed AWS security services and, serverless technologies to continuously prevent, detect and respond to threats. You sleep in fragmented glass With reflections o...

Security Bulletin: A dependency of ElasticSearch as used in IBM® Resilient SOAR is vulnerable to Apache Log4j (CVE-2021-44228).

Summary Apache Log4j, a dependency of ElasticSearch as used in IBM® Resilient SOAR, is vulnerable to information disclosure. Elastic Search is used by IBM® Resilient SOAR for text search. This bulletin provides a mitigation for the vulnerability. Customers are encouraged to update their systems n...

SUSE-SU-2021:4160-1 Security update for logstash, elasticsearch, kafka, zookeeper, openstack-monasca-agent, openstack-monasca-persister-java, openstack-monasca-thresh

This update for logstash, elasticsearch, kafka, zookeeper, openstack-monasca-agent, openstack-monasca-persister-java, openstack-monasca-thresh fixes the following issues: Fixed vulnerability related to log4j version 1.2.x: - CVE-2021-4104: Fixed remote code execution through the JMS API via the...

Elastic Elasticsearch Multiple Log4j Vulnerabilities (Dec 2021)

Elastic Elasticsearch is prone to multiple vulnerabilities in the Apache Log4j library. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Security Bulletin: Apache Log4j vulnerability affects IBM Business Automation Workflow (CVE-2021-44228)

Summary Process Federation Server PFS, shipped with IBM Business Automation Workflow BAW, is vulnerable to a vulnerability caused by log4j. The vulnerability is included in the ElasticSearch client library used by PFS. The ElasticSearch vulnerable library was also shipped in offline documentation...