2659 matches found
Default configuration
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. NOTE: this only violates the vendor's intended security policy if the user does not run...
CVE-2014-3120
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. NOTE: this only violates the vendor's intended security policy if the user does not run...
CVE-2014-3120
CVE-2014-3120 : Elasticsearch’s default configuration prior to certain builds enables dynamic scripting, allowing remote attackers to execute arbitrary MVEL expressions and Java code via the _search source parameter. Public references indicate this enables remote code execution and constitutes a ...
CVE-2014-3120
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. NOTE: this only violates the vendor's intended security policy if the user does not run...
PT-2014-5099
Name of the Vulnerable Software and Affected Versions Elasticsearch versions prior to 1.2 Description The default configuration in Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to the search...
CVE-2014-3120
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. NOTE: this only violates the vendor’s intended security policy if the user does not run...
CVE-2014-4326
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in 1 zabbix.rb or 2 nagiosnsca.rb in outputs/...
Design/Logic Flaw
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in 1 zabbix.rb or 2 nagiosnsca.rb in outputs/...
CVE-2014-4326
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in 1 zabbix.rb or 2 nagiosnsca.rb in outputs/...
CVE-2014-4326
CVE-2014-4326 affects Elastic/Logstash prior to 1.4.2 when configured with the Zabbix or Nagios outputs. A crafted event sent to the outputs/ handlers (zabbix.rb or nagios_nsca.rb) allows remote code execution, enabling an attacker to run arbitrary OS commands. Affected versions are Logstash 1.0....
Elasticsearch 'source' Parameter RCE
The Elasticsearch application hosted on the remote web server is affected by a remote code execution vulnerability due to a failure to properly sanitize user-supplied input to the 'source' parameter of the '/search' page. A remote, unauthenticated attacker can exploit this flaw to execute arbitra...
Elasticsearch remote execution vulnerability affects a large number of domestic server in the cluster-vulnerability warning-the black bar safety net
From Satan online searching key words:“You Know,for search country:CN port:9 2 0 0” Transfer door: http://www.shodanhq.com/search?q=You+Know%2Cfor+search+country%3ACN+port%3A9200 Well, a big wave to open the Elasticsearch service of the server appears: ! So in this one how many you can use? Wrote...
the elasticsearch exploit tool kit-vulnerability warning-the black bar safety net
ElasticSearch is based on Lucene to build the open source, distributed, RESTful search engine. Designed for cloud computing, it is possible to achieve real-time search, stable, reliable, fast, install easy to use. Support through HTTP using the JSON data index. ! Please do not used for illegal...
Exploit for Improper Access Control in Elasticsearch
ElasticSearch search Remote Code Execution CVE-2014-3120 =====...
ElasticSearch Dynamic Script Arbitrary Java Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...
Hooker - Automated Dynamic Analysis of Android Applications
Hooker is an opensource project for dynamic analysis of Android applications. This project provides various tools and applications that can be use to automaticaly intercept and modify any API calls made by a targeted application. It leverages Android Substrate framework to intercept these calls a...
Bro - Passive Open-Source Network Traffic Analyzer
While focusing on network security monitoring, Bro provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Bro has successfully bridged the traditional gap between academia and operations since its inception. Today, it ...
ElasticSearch Dynamic Script Arbitrary Java Execution
Exploit for java platform in category remote exploits This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ElasticSearch Dynamic Script Arbitrary Java Execution', 'Description' = %q This...
ElasticSearch Dynamic Script Arbitrary Java Execution
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ElasticSearch Dynamic Script Arbitrary Java Execution', 'Description' = %q This module exploits a remote command execution...
ElasticSearch Dynamic Script - Arbitrary Java Execution (Metasploit)
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ElasticSearch Dynamic Script Arbitrary Java Execution', 'Description' = %q This module exploits a remote command execution...