Kibana Open Redirect Vulnerability

Kibana is an open source data visualization plugin for Elasticsearch. Kibana suffers from an open redirection vulnerability that allows an attacker to craft links that redirect to arbitrary websites...

Elasticsearch Kibana Cross-Site Scripting Vulnerability (CNVD-2017-15521)

Elasticsearch Kibana is a suite of open source, browser-based tools for analyzing and searching Elasticsearch dashboards. A cross-site scripting vulnerability exists in Elasticsearch Kibana, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which...

CVE-2016-10362

Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials...

CVE-2016-10362

Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials...

CVE-2016-1000221

Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information...

Authorization

Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information...

Design/Logic Flaw

Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials...

CVE-2016-1000221

Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information...

CVE-2016-1000221

Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information...

CVE-2016-1000221

The CVE refers to Elastic Stack: Logstash prior to version 2.3.4 with the Elasticsearch Output plugin could log HTTP Authorization headers to files, exposing sensitive information. Affected component/file: Logstash/Elasticsearch Output plugin; root cause: logging of sensitive HTTP headers. Impact...

CVE-2016-10362

Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials...

CVE-2016-10362

Summary: CVE-2016-10362 affects Logstash prior to 5.0.1, where the Elasticsearch Output plugin could log HTTP basic auth credentials to a file when updating connections after sniffing. This is an information disclosure vulnerability affecting the plugin behavior in Logstash’s core workflow. Impac...

Logstash Logs Sensitive Information

Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information...

Elasticsearch Logstash Information Disclosure Vulnerability

Elasticsearch Logstash is a set of log analysis and monitoring tools from Elasticsearch Netherlands. The tool provides functions such as search, processing and management of logs or events. An information disclosure vulnerability exists in Elasticsearch Logstash versions prior to 5.0.1. An attack...

ElasticSearch X-Pack Security Information Disclosure Vulnerability

ElasticSearch X-Pack is an extension of the Elastic Stack log analysis system from the Dutch company Elasticsearch. security is one of the features used to control access rights. An information disclosure vulnerability exists in ElasticSearch X-Pack Security versions prior to 5.4.1 and versions...

Elasticsearch Kibana cross-site scripting vulnerability (CNVD-2017-11644)

Elasticsearch Kibana formerly known as elasticsearch-dashboard is a suite of open source, browser-based analytics and search Elasticsearch dashboard tools from Elasticsearch Netherlands.Time Series Visual Builder is a visualization function. A cross-site scripting vulnerability exists in Time...

Elasticsearch Kibana cross-site scripting vulnerability (CNVD-2017-11643)

Elasticsearch Kibana formerly known as elasticsearch-dashboard is a suite of open-source, browser-based analytics and search Elasticsearch dashboard tools from the Dutch company Elasticsearch. A cross-site scripting vulnerability exists in the Discover page in Elasticsearch Kibana versions 5.3 an...

ElasticSearch X-Pack Security Elevation of Privilege Vulnerability

ElasticSearch X-Pack is an extension of the Elastic Stack log analysis system from the Dutch company Elasticsearch. security is one of the features used to control access rights. An elevation of privilege vulnerability exists in the runas feature in ElasticSearch X-Pack Security versions 5.0.0...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R2 security and bug fix update

An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

elasticsearch: remote code execution via Groovy sandbox bypass

It was reported that Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerability allows an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM...