Unsecured Adobe Server Exposes Data for 7.5 Million Creative Cloud Users

The U.S. multinational computer software company Adobe has suffered a serious security breach earlier this month that exposed user records' database belonging to the company's popular Creative Cloud service. With an estimated 15 million subscribers, Adobe Creative Cloud or Adobe CC is a...

Information Disclosure

A username disclosure flaw was found in Elasticsearch’s API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...

Elasticsearch Logstash Beats Input Plugin CVE-2019-7620 Denial of Service Vulnerability

Description Elasticsearch Logstash is prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause the the application to stop responding, denying service to legitimate users. Technologies Affected Elasticsearch Logstash 1.0.14 Elasticsearch Logstash 1.0.15 Elasticsearc...

Elasticsearch CVE-2019-7619 Information Disclosure Vulnerability

Description Elasticsearch is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks. Versions prior to Elasticsearch 7.4.0 or 6.8.4 are vulnerable. Technologies Affected Elasticsearch...

Elasticsearch Information Disclosure Vulnerability (CNVD-2019-39403)

Elasticsearch is a set of Dutch Elasticsearch company built on Lucene open source distributed RESTful search engine . The product is mainly used in cloud computing , and supports data indexing via HTTP using JSON. There is an information disclosure vulnerability in Elasticsearch , the vulnerabili...

Elastic Stack 6.8.4 security update

Elasticsearch username disclosure flaw ESA-2019-13 A username disclosure flaw was found in Elasticsearch’s API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm. Affected Versions The following...

GitLab: Elasticsearch leaks data through the notes scope

Summary The Elasticsearch results, when filtering using the notes scope, leaks data about private groups, private projects, and private issues. Steps to reproduce 1. Search, as an anonymous user, nextbit in the Gitlab group, filtering for "comments" link 2. You will have as result a private note...

Gitlab -- Disclosure Vulnerabilities

Gitlab reports: Disclosure of Private Code, Merge Requests and Commits via Elasticsearch integration...

Leaky database exposes tax records of 20 million Russians

By Sudais According to a report by Comparitech, more than 20 million tax records were found on an unprotected Amazon Web Services AWS Elasticsearch Cluste This is a post from HackRead.com Read the original post: Leaky database exposes tax records of 20 million Russians...

Elastic Stack 7.4.0 security update

Elastic Code local file disclosure flaw ESA-2019-12 A local file disclosure flaw was found in Elastic Code. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with the permission of the Kibana...

IT Firm Manager Arrested in the Biggest Data Breach Case of Ecuador's History

Ecuador officials have arrested the general manager of IT consulting firm Novaestrat after the personal details of almost the entire population of the Republic of Ecuador left exposed online in what seems to be the most significant data breach in the country's history. Personal records of more th...

floragunn Search Guard Information Disclosure Vulnerability (CNVD-2019-32495)

floragunn Search Guard is a German floragunn company for Elasticsearch and ELK open source plug-ins , it mainly provides encryption , authentication , authorization management and log auditing and other functions . An information disclosure vulnerability exists in versions prior to floragunn Sear...

floragunn Search Guard Authorization Issue Vulnerability (CNVD-2019-32491)

floragunn Search Guard is a German floragunn company for Elasticsearch and ELK open source plug-ins , it mainly provides encryption , authentication , authorization management and log auditing and other functions . An authorization issue vulnerability exists in versions prior to floragunn Search...

floragunn Search Guard Information Disclosure Vulnerability (CNVD-2019-32494)

floragunn Search Guard is a German floragunn company for Elasticsearch and ELK open source plug-ins , it mainly provides encryption , authentication , authorization management and log auditing and other functions . An information disclosure vulnerability exists in versions prior to floragunn Sear...

ACT Platform - Open Platform For Collection And Exchange Of Threat Intelligence Information

Semi-Automated Cyber Threat Intelligence ACT is a research project led by mnemonic as with contributions from the University of Oslo, NTNU, Norwegian Security Authority NSM, KraftCERT and Nordic Financial CERT. The main objective of the ACT project is to develop a platform for cyber threat...

Qualys Cloud Platform 8.21.2 New Features

The upcoming release of the Qualys Cloud Platform VM, PC, version 8.21.2, includes several new features in Qualys Cloud Platform and support for multiple technologies in Qualys Policy Compliance. The 8.21.2 release is scheduled to go live on 16th Sept, 2019. See full 8.21.2 new features blog post...

Data Leak Impacts Millions of Yves Rocher Cosmetics Company Customers

UPDATE Cosmetics giant Yves Rocher is warning that a giant data leak exposed the personal data of millions of its customers and reams of sensitive internal company information to the public. The data exposure stems from a database left unprotected by a third-party consultant to the firm...

CVE-2019-7614

A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user...

RedHunt OS v2 - Virtual Machine For Adversary Emulation And Threat Hunting

Virtual Machine for Adversary Emulation and Threat Hunting by RedHunt Labs RedHunt OS aims to be a one stop shop for all your threat emulation and threat hunting needs by integrating attacker's arsenal as well as defender's toolkit to actively identify the threats in your environment. Base Machin...

floragunn Search Guard Information Disclosure Vulnerability

floragunn Search Guard is a German floragunn company for Elasticsearch and ELK open source plug-ins , it mainly provides encryption , authentication , authorization management and log auditing and other functions . An information disclosure vulnerability exists in versions prior to floragunn Sear...