VPN Exposes Data for 1M Users, Leading to Researcher Questioning

Free virtual private network VPN service Quickfox, which provides access to Chinese websites from outside the country, exposed the personally identifiable information PII of more than a million users in just the latest high-profile VPN security failure. The incident has some security practitioner...

Security Bulletin: Operations Dashboard is vulnerable to Elasticsearch Go vulnerabilities (CVE-2021-22144 & CVE-2021-22145)

Summary Operations Dashboard is vulnerable to Elasticsearch vulnerabilities CVE-2021-22144 & CVE-2021-22145 with details of each below Vulnerability Details CVEID: CVE-2021-22144 DESCRIPTION: Elasticsearch is vulnerable to a denial of service, caused by an uncontrolled recursion vulnerability in...

The Telegraph newspaper exposed 10TB of subscriber data

By Deeba Ahmed The data was exposed due to an unprotected Elasticsearch cluster and remained open to public access without any security authentication. This is a post from HackRead.com Read the original post: The Telegraph newspaper exposed 10TB of subscriber data...

Elastic: CVE-2021-40870 on [52.204.160.31]

An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal. The IP has a SSL certificate pointing to ElasticSearch. curl -kv...

Elastic Elasticsearch Installed (Linux)

Binary data elasticelasticsearchnixinstalled.nbin...

Security Bulletin: Multiple vulnerabilities may affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) offline documentation

Summary IBM Business Process Manager and IBM Business Automation Workflow offline documentation packages open source libraries with known vulnerabilities. Do not install offline documentation and remove existing installations with the fix provided below. Vulnerability Details CVEID: CVE-2021-2335...

Security Bulletin: IBM Security SOAR is using a version of Elasticsearch that has known vulnerabilities (CVE-2021-22137, CVE-2021-22135)

Summary IBM Security SOAR is using a version of Elasticsearch that has known vulnerabilities. A recent update has addressed these issues. Vulnerability Details CVEID: CVE-2021-22137 DESCRIPTION: Elasticsearch could allow a remote authenticated attacker to obtain sensitive information, caused by a...

Elastic Elasticsearch Privilege Escalation Vulnerability (ESA-2021-25)

Elastic Elasticsearch is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

GHSA-J8WC-GXX9-82HX vulnerabilities

Vulnerabilities for packages: elasticsearch...

GHSA-45H5-R968-5XR7 Exposure of sensitive information in Elasticsearch

A flaw was discovered in Elasticsearch where document and field level security was not applied to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...

Exposure of sensitive information in Elasticsearch

A flaw was discovered in Elasticsearch where document and field level security was not applied to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...

CVE-2021-40690 vulnerabilities

Vulnerabilities for packages: elasticsearch...

Information Disclosure

elasticsearch is vulnerable to information disclosure. The vulnerability exists due to lack of security level applied to searchable snapshots, allowing an attacker to gain access to unauthorized information...

Elastic Elasticsearch Information Disclosure Vulnerability (ESA-2021-18)

Elasticsearch is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2021-22147

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...

CVE-2021-22147

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...

Information disclosure

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...

CVE-2021-22147

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...

CVE-2021-22147

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...

UBUNTU-CVE-2021-22147

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...