Adult Content Site Exposed Personal Data of 1M Users

The personal information more than a million users of popular adult website Luscious, including email addresses that sometimes indicated full names, were found exposed in an unsecured Elasticsearch database. The website, which focuses on anime-themed, user-uploaded adult content, has over 1 milli...

Firmware Slap - Discovering Vulnerabilities In Firmware Through Concolic Analysis And Function Clustering

Firmware slap combines concolic analysis with function clustering for vulnerability discovery and function similarity in firmware. Firmware slap is built as a series of libraries and exports most information as either pickles or JSON for integration with other tools. Slides from the talk can be...

floragunn Search Guard Input Validation Error Vulnerability

floragunn Search Guard is a German floragunn company for Elasticsearch and ELK open source plug-ins , it mainly provides encryption , authentication , authorization management and log auditing and other functions . An input validation error vulnerability exists in versions prior to floragunn Sear...

floragunn Search Guard Information Disclosure Vulnerability (CNVD-2019-44763)

floragunn Search Guard is a German floragunn company for Elasticsearch and ELK open source plug-ins , it mainly provides encryption , authentication , authorization management and log auditing and other functions . floragunn Search Guard 24.0 before the version of the information leakage...

Elastic Elasticsearch < 6.8.2, 7.x < 7.2.1 Information Disclosure Vulnerability (ESA-2019-07) - Linux

Elasticsearch is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Elastic Elasticsearch < 6.8.2, 7.x < 7.2.1 Information Disclosure Vulnerability (ESA-2019-07) - Windows

Elasticsearch is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Skadi - Collect, Process, And Hunt With Host Based Data From MacOS, Windows, And Linux

pronounced “SKAH-Dee”: similar to Scotty but with a d sound is a giantess and goddess of hunting in Norse mythology Purpose Skadi is a free, open source collection of tools that enables the collection, processing and advanced analysis of forensic artifacts and images. It works on MacOS, Windows,...

HELK - The Hunting ELK

The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was developed...

CVE-2019-7885

Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure th...

Information Leakage

Elasticsearch is vulnerable to information leakage. An attacker can gain access to the other user's sensitive information in the response header if multiple users submitting requests, causing a race condition in response headers...

Elasticsearch Elastic APM agent for Ruby certificate validation error vulnerability

Elasticsearch Elastic APM agent for Ruby is a Ruby-based Elastic APM Application Performance Monitoring agent from the Dutch company Elasticsearch. A certificate validation error vulnerability in Elastic APM agent for Ruby prior to version 2.9.0 can be exploited to conduct a man-in-the-middle...

Elasticsearch Competitive Conditions Issue Vulnerability

Elasticsearch is a set of Dutch Elasticsearch company built on Lucene open source distributed RESTful search engine . The product is mainly used in cloud computing , and supports data indexing via HTTP using JSON. A competitive condition issue vulnerability exists in Elasticsearch versions prior ...

CVE-2019-7614

A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user...

CVE-2019-7614

A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user...

Race condition

A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user...

CVE-2019-7614

A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user...

CVE-2019-7614

CVE-2019-7614 is a race-condition in Elasticsearch’s response headers that could let a remote authenticated attacker access another user’s header data. The CVE is described across IBM Tivoli Netcool Impact advisories and related IBM Cloud Private entries, applying to Elasticsearch shippd with Net...

CVE-2019-7614

A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user...

Elastic Stack 6.8.2 and 7.2.1 security update

Elasticsearch race condition flaw ESA-2019-07 A race condition flaw was found in the response headers Elasticsearch returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from...

PT-2019-18666 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions prior to 7.2.1 Elasticsearch versions prior to 6.8.2 Description: A race condition flaw was found in the response headers returned by Elasticsearch. On a system with multiple users submitting requests, it could be...