UBUNTU-CVE-2020-7019

In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attack...

CVE-2020-7019

In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attack...

CVE-2020-7019

CVE-2020-7019 affects Elasticsearch versions prior to 7.9.0 and 6.8.12. A field disclosure flaw occurs when running a scrolling search with Field Level Security: if a user runs the same query another, more privileged user recently ran, the scrolling search can leak hidden fields, potentially gran...

Elastic Stack 7.9.0 and 6.8.12 Security Update

Elasticsearch field disclosure flaw ESA-2020-12 A field disclosure flaw was found in Elasticsearch when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This...

PT-2020-19344 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions prior to 7.9.0 Elasticsearch versions prior to 6.8.12 Description: A field disclosure flaw was found in Elasticsearch when running a scrolling search with Field Level Security. If a user runs the same query another more...

Elasticsearch Privilege Escalation (CVE-2020-7014)

A privilege escalation vulnerability exists in Elasticsearch. An attacker who is able to generate an API key and an authentication token can perform a series of steps that result in an authentication token being generated with elevated privileges...

DAGOBAH - Open Source Tool To Generate Internal Threat Intelligence, Inventory & Compliance Data From AWS Resources

Dagobah is an open source tool written in python to automate the internal threat intelligence generation, inventory collection and compliance check from different AWS resources. Dagobah collects information and save the state into an elasticsearch index. Dagobah runs into the a LAMBDA and looks a...

elasticsearch: Information exposure via _cluster/settings API

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This...

Important: Red Hat Security Advisory: Red Hat Fuse 7.7.0 release and security update

A minor version update from 7.6 to 7.7 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

Elasticsearch Privilege Escalation (CVE-2020-7009)

A privilege escalation vulnerability exists in Elasticsearch. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...

Elasticsearch Kibana Cross-Site Scripting Vulnerability (CNVD-2020-49490)

Elasticsearch Kibana is a suite of open source, browser-based analytics and search Elasticsearch dashboard tools from Elasticsearch Netherlands. A cross-site scripting vulnerability exists in Elasticsearch Kibana versions prior to 6.8.11 and prior to 7.8.1. The vulnerability stems from the WEB...

Elasticsearch MachineLearning XML External Entities (CVE-2018-17247)

An XML external entities vulnerability exists in Machine Learning's findfilestructure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the...

Elasticsearch Kibana Resource Management Error Vulnerability

Elasticsearch Kibana is a suite of open source, browser-based analytics and search Elasticsearch dashboard tools from Elasticsearch Netherlands. A security vulnerability exists in Elasticsearch Kibana versions prior to 6.8.11 and prior to 7.8.1. An attacker can exploit the vulnerability with the...

Leak Exposes Private Data of Genealogy Service Users

A server containing information of users of a genealogy service has exposed the data of 60,000 users, putting them at risk for fraud, phishing and other cybercriminal activity. Research led by Avishai Efrat at WizCase has discovered the leak, which affected an open and unencrypted ElasticSearch...

Kibana Elasticsearch Server Side Request Forgery (CVE-2019-7616)

A server side request forgery vulnerability exists in Kibana Elasticsearch. Successful exploitation of this vulnerability could possibly lead to an attacker accessing external URL resources as the Kibana process on the host system...

Photon OS 2.0: Elasticsearch PHSA-2020-2.0-0253

An update of the elasticsearch package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0253. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2020-7014

The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication...

CVE-2020-7011

A flaw was found in elasticsearch. If the Reference UI injects a URL into a result, that URL will be rendered by the web browser. If an attacker is able to control the contents of such a field, they could execute arbitrary JavaScript in the victim's web browser...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Elastic Elasticsearch

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Elastic Elasticsearch. Vulnerability Details CVEID: CVE-2020-7009 DESCRIPTION: Elastic Elasticsearch could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a flaw in...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-1.0-0301

An update of 'systemd', 'openssh', 'expat', 'perl', 'elasticsearch', 'kibana' packages of Photon OS has been released...