PT-2022-24506 · Elastic +1 · Elasticsearch +1

Name of the Vulnerable Software and Affected Versions: HCL Commerce affected versions not specified Description: The issue allows a remote attacker to cause a denial of service attack on the site and make administrative changes when HCL Commerce is used with Elasticsearch. Recommendations: At the...

Security Bulletin: Netcool Operations Insight v1.6.6 contains fixes for multiple security vulnerabilities.

Summary Netcool Operations Insight v1.6.6 contains fixes for multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2021-23450 DESCRIPTION: Dojo could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution in the...

Covid antigen test results of 1.7m Indian and foreign nationals leaked online

By Waqas The exposed Elasticsearch server belongs to an Indian healthcare software company that has not secured the database despite being alerted. This is a post from HackRead.com Read the original post: Covid antigen test results of 1.7m Indian and foreign nationals leaked online...

CVE-2022-38299

An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint...

Design/Logic Flaw

An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint...

CVE-2022-38299

An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint...

CVE-2022-38299

An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint...

CVE-2022-38299

Summary : CVE-2022-38299 affects Appsmith v1.7.11 via its Elasticsearch plugin, where the underlying issue allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint. The NVD entry assigns a CVSSv3.1 base score of 4.3 (Network, Low attack complexity, Low privileges, no...

PT-2022-24349 · Appsmith +1 · Appsmith +1

Name of the Vulnerable Software and Affected Versions: Appsmith version 1.7.11 Description: An issue in the Elasticsearch plugin allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint. Recommendations: For Appsmith version 1.7.11, consider disabling the Elasticsear...

Appsmith 安全漏洞

Appsmith is an open source platform for building, deploying and maintaining on-premise applications from Appsmith Open Source. A security vulnerability exists in Appsmith version v1.7.11, which stems from an issue in the Elasticsearch plugin that allows an attacker to connect unallowed hosts to...

elasticsearch: Document disclosure flaw when Document or Field Level Security is used

In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the...

elasticsearch: executing async search improperly stores HTTP headers leading to information disclosure

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in...

CVE-2022-23715

A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings values in logs such as the audit log or deployment logs in the Logging and Monitoring cluster. The affected APIs are PATCH /api/v1/user a...

Design/Logic Flaw

A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings values in logs such as the audit log or deployment logs in the Logging and Monitoring cluster. The affected APIs are PATCH /api/v1/user a...

CVE-2022-23715

A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings values in logs such as the audit log or deployment logs in the Logging and Monitoring cluster. The affected APIs are PATCH /api/v1/user a...

Major Database Mess Up Leaves Indian Federal Police and Banking Records Exposed

By Deeba Ahmed In total, the publically exposed Elasticsearch database contained a whopping 335 million records or roughly 24GB worth of highly sensitive data. This is a post from HackRead.com Read the original post: Major Database Mess Up Leaves Indian Federal Police and Banking Records Exposed...

Elastic Stack 8.4.0, 7.17.6 Security Statement

Elastic Statement for Oracle July Critical Patch Update CVE-2022-21540, CVE-2022-21541, CVE-2022-21549, CVE-2022-25647, CVE-2022-34169 Summary : Oracle released their July Critical Patch Update for Java SE which contains 5 CVEs. Elastic has analyzed the flaws described by these CVEs and the...

Elastic Elasticsearch Multiple Log4j Vulnerabilities (ESA-2021-31, Log4Shell) - Active Check

Elastic Elasticsearch is prone to multiple vulnerabilities in the Apache Log4j library. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for June 2022

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 21.0.2-IF012 and 21.0.3-IF010. Vulnerability Details CVEID:CVE-2021-43138 DESCRIPTION: Async could allow a remote attacker to...

elasticsearch: executing async search improperly stores HTTP headers leading to information disclosure

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in...