2255 matches found
Elasticsearch Kibana cross-site scripting vulnerability (CNVD-2017-11643)
Elasticsearch Kibana formerly known as elasticsearch-dashboard is a suite of open-source, browser-based analytics and search Elasticsearch dashboard tools from the Dutch company Elasticsearch. A cross-site scripting vulnerability exists in the Discover page in Elasticsearch Kibana versions 5.3 an...
ElasticSearch X-Pack Security Information Disclosure Vulnerability
ElasticSearch X-Pack is an extension of the Elastic Stack log analysis system from the Dutch company Elasticsearch. security is one of the features used to control access rights. An information disclosure vulnerability exists in ElasticSearch X-Pack Security versions prior to 5.4.1 and versions...
elasticsearch: remote code execution via Groovy sandbox bypass
It was reported that Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerability allows an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM...
Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R2 security and bug fix update
An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...
'Anonymous' FTP Servers Leaving Healthcare Data Exposed
Hackers craving personal health care information are targeting exposed FTP servers. The FBI issued a warning last week that focused on an increase in criminal activity targeting FTP servers used by medical and dental organizations that are configured to allow anonymous access without...
Open Source Large Scale Full Packet Capturing: Moloch
Open Source Large Scale Full Packet Capturing Moloch is an open source, large scale, full packet capturing, indexing, and database system. Moloch augments your current security infrastructure to store and index network traffic in standard PCAP format, providing fast, indexed access. An intuitive...
Personalized User Focused Security: Stethoscope
Stethoscope is a web application that collects information from existing device data sources e.g., JAMF or LANDESK on a given user’s devices and gives them clear and specific recommendations for securing their systems. Stethoscope consists of two primary pieces: a Python-based back-end and a...
Remote Code Execution (RCE)
Elasticsearch is vulnerable to arbitrary code execution. This is because dynamic scripting is enabled by default, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search...
Information Disclosure Through Logs
logstash-core is vulnerable to information disclosure. The vulnerability is possible because it logs information from HTTP authorization headers which could contain sensitive information. Users who use secure communication from logstash to elasticsearch via basic authorization using elastic shiel...
IntelMQ - A solution for IT security teams for collecting and processing security feeds using a message queuing protocol
IntelMQ is a solution for IT security teams CERTs, CSIRTs, abuse departments,... for collecting and processing security feeds such as log files using a message queuing protocol. It's a community driven initiative called IHAP Incident Handling Automation Project which was conceptually designed by...
Protect your data from ransom attacks
I wanted to bring attention to two blog posts we have done recently in response to the recent set of data ransom attacks affecting Elasticsearch and other systems. The two are: For Elasticsearch: Protecting Against Attacks that Hold Your Data for Ransom For Kibana: Guarding Kibana from Data...
Malware exploit: Xdh
Type: Remote Code Execution Author: shipcod3 / Jay Turla This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule Msf::Exploit::Remote Rank = ExcellentRanking include...
Exploit for CVE-2015-1427
Elasticsearch 1.4.0 1.4.2 Remote Code Execution Elastics...
Pornhub: Unsecured Kibana/Elasticsearch instance
The researcher has found an insecure Kibana instance accessible to the public. A publicly accessible Kibana instance was identified. This vulnerability was discovered using the infrastructure monitoring platform BugLabs.me - http://buglabs.me...
F-Scrack - A Single File Bruteforcer Supports Multi-Protocol
F-Scrack is a single file bruteforcer supports multi-protocol, no extra library requires except python standard library, which is ideal for a quick test. Currently support protocol: FTP, MySQL, MSSQL，MongoDB，Redis，Telnet，Elasticsearch，PostgreSQL. Compatible with OSX, Linux, Windows, Python 2.6+...
Logstash 5.0.1 released with a security patch
Hi all, we would like to announce that Logstash 5.0.1 has been released with an important security patch. Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials. We advise our users using Logstash and...
Elasticsearch Detection
Binary data 9778.prm...
Free Open Source Scalable Incident Response Platform: The Hive
Free Open Source Scalable Incident Response Platform TheHive is a scalable 3-in-1 open source and free solution designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly. TheHi...
Regular Expression Denial Of Service (ReDoS)
elasticsearch is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can trigger a infinite loop using two successive wildcard characters which can lead to a denial of service...
