CVE-2019-18460

Removed by vendor...

CVE-2019-18456: Incorrect Permission Assignment for Critical Resource

An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insecure Permissions issue 1 of 4...

PT-2019-15417

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.15 through 12.4 Description The issue is related to Incorrect Access Control in the Comments Search feature, which is provided by the Elasticsearch integration. Recommendations For GitLab...

CVE-2019-18460: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control...

PT-2019-15413

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 8.17 through 12.4 Description An issue was discovered in the Search feature provided by Elasticsearch integration, related to Insecure Permissions. Recommendations For GitLab Community and...

Data-Enriched Profiles on 1.2B People Exposed in Gigantic Leak

An open Elasticsearch server has exposed the rich profiles of more than 1.2 billion people to the open internet. First found on October 16 by researchers Bob Diachenko and Vinny Troia, the database contains more than 4 terabytes of data. It consists of scraped information from social media source...

CVE-2019-7619

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...

CVE-2019-7619

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...

Design/Logic Flaw

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...

CVE-2019-7619

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...

CVE-2019-7619

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...

CVE-2019-7619

CVE-2019-7619 affects Elasticsearch versions 7.0.0–7.3.2 and 6.7.0–6.8.3, where an unauthenticated attacker could use the API Key service to determine if a username exists in the native realm due to a username-disclosure flaw. The connected documents corroborate a username disclosure vulnerabilit...

CVE-2019-7619

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...

CVE-2019-7619: Exposure of Sensitive Information to an Unauthorized Actor

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...

PT-2019-18671

Name of the Vulnerable Software and Affected Versions Elasticsearch versions 6.7.0 through 6.8.3 Elasticsearch versions 7.0.0 through 7.3.2 Description A username disclosure flaw was found in the API Key service of Elasticsearch. An unauthenticated attacker could send a specially crafted request ...

Gitlab -- Disclosure Vulnerabilities

Gitlab reports: Source branch of a MR could be removed by an unauthorised user Private group members could be listed Disclosure of System Notes via Elasticsearch integration Disclosure of Private Comments via Elasticsearch integration Confirm existence of private repositories Private group...

Unsecured Adobe Server Exposes Data for 7.5 Million Creative Cloud Users

The U.S. multinational computer software company Adobe has suffered a serious security breach earlier this month that exposed user records' database belonging to the company's popular Creative Cloud service. With an estimated 15 million subscribers, Adobe Creative Cloud or Adobe CC is a...

Information Disclosure

A username disclosure flaw was found in Elasticsearch’s API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...

Elasticsearch Logstash Beats Input Plugin CVE-2019-7620 Denial of Service Vulnerability

Description Elasticsearch Logstash is prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause the the application to stop responding, denying service to legitimate users. Technologies Affected Elasticsearch Logstash 1.0.14 Elasticsearch Logstash 1.0.15 Elasticsearc...

Elasticsearch Information Disclosure Vulnerability (CNVD-2019-39403)

Elasticsearch is a set of Dutch Elasticsearch company built on Lucene open source distributed RESTful search engine . The product is mainly used in cloud computing , and supports data indexing via HTTP using JSON. There is an information disclosure vulnerability in Elasticsearch , the vulnerabili...