Elasticsearch 日志信息泄露漏洞

Elasticsearch is a set of Dutch Elasticsearch company built on Lucene open source distributed RESTful search engine . The product is mainly used in cloud computing , and supports data indexing via HTTP using JSON. A log information disclosure vulnerability exists in Elasticsearch that originates...

CVE-2020-7021: Insertion of Sensitive Information into Log File

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emitrequestbody option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch...

Spotify Suffers Second Credential-Stuffing Cyberattack

Spotify streaming music aficionados are in the crosshairs of yet another credential-stuffing cyberattack, just three months after the last one. The service has forced password resets for impacted users. Cybercriminals carrying out credential-stuffing take advantage of people who reuse the same...

CVE-2020-15097

loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a search index and a peer-to-peer index sharing interface. All messages are stored in an elasticsearch index. In loklak less than or equal to commit 5f48476, ...

CVE-2020-15097

loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a search index and a peer-to-peer index sharing interface. All messages are stored in an elasticsearch index. In loklak less than or equal to commit 5f48476, ...

Path traversal

loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a search index and a peer-to-peer index sharing interface. All messages are stored in an elasticsearch index. In loklak less than or equal to commit 5f48476, ...

CVE-2020-15097 Path Traversal in loklak

loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a search index and a peer-to-peer index sharing interface. All messages are stored in an elasticsearch index. In loklak less than or equal to commit 5f48476, ...

CVE-2020-15097

CVE-2020-15097 applies to loklak: a path traversal vulnerability due to insufficient input validation in loklak server APIs, enabling reading admin configuration/files on the host and potentially writing user-controlled content to admin files. Impact is limited to systems running loklak prior to ...

CVE-2021-22132

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in...

BYKEA data breach: Pakistani ride-hailing app exposed 400m records

By Waqas According to researchers, BYKEA's 200 GB worth of database was exposed on an Elasticsearch server. This is a post from HackRead.com Read the original post: BYKEA data breach: Pakistani ride-hailing app exposed 400m records...

Elastic Elasticsearch Information Disclosure Vulnerability (ESA-2020-13)

Elasticsearch is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Elastic Elasticsearch Privilege Escalation Vulnerability (ESA-2020-02)

Elasticsearch is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Elastic Elasticsearch Information Disclosure Vulnerability (ESA-2021-01)

Elasticsearch is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Elastic Elasticsearch Privilege Escalation Vulnerability (ESA-2020-07)

Elasticsearch is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Elastic Elasticsearch Username Disclosure Vulnerability (ESA-2019-13)

Elasticsearch is prone to a username disclosure vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Elastic Elasticsearch Security < 5.6.15 / 6.x < 6.6.1 Permission Issue (ESA-2019-04)

Elasticsearch Security is prone to a permission issue. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:elastic:elasticsearch";...

Elastic Elasticsearch Security Information Disclosure Vulnerability (ESA-2018-19)

Elasticsearch Security is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Elastic Elasticsearch < 6.3.0 Information Exposure Vulnerability (ESA-2018-11)

Elasticsearch is prone to an information exposure vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Vulnerability fixed in Elasticsearch

A vulnerability has been fixed in Elasticsearch. The vulnerability allows a malicious person to obtain system data. Elastic has released updates to fix the vulnerability. More information can be found on the page below: https://discuss.elastic.co/t/elasticsearch-7-10-2-security-update /261164...

Elasticsearch Information Disclosure Vulnerability (CNVD-2021-03548)

Elasticsearch is a search engine based on the Lucene library. An information disclosure vulnerability exists in the asynchronous search API in Elasticsearch 7.7.0 - 7.10.1. The vulnerability stems from the fact that users performing asynchronous searches will incorrectly store HTTP headers. An...