ElasticSearch Snapshot API Directory Traversal

'This module exploits a directory traversal vulnerability in ElasticSearch, allowing an attacker to read arbitrary files with JVM process privileges, through the Snapshot API.' This module requires Metasploit: https://metasploit.com/download Current source:...

Elasticsearch _river 越权访问漏洞

No description provided by source...

ElasticSearch 1.6.0 - Arbitrary File Download Vulnerability

Exploit for linux platform in category web applications elasticpwn Script for ElasticSearch url path traversal vuln. CVE-2015-5531 email protected elasticpwn$ python CVE-2015-5531.py exploitlab.int /etc/hosts !dSR script for CVE-2015-5531 127.0.0.1 localhost The following lines are desirable for...

ElasticSearch 1.6.0 - Arbitrary File Download

ElasticSearch 1.6.0 - Arbitrary File Download elasticpwn Script for ElasticSearch url path traversal vuln. CVE-2015-5531 crg@fogheaven elasticpwn$ python CVE-2015-5531.py exploitlab.int /etc/hosts !dSR script for CVE-2015-5531 127.0.0.1 localhost The following lines are desirable for IPv6 capable...

ElasticSearch 1.6.0 - Arbitrary File Download

elasticpwn Script for ElasticSearch url path traversal vuln. CVE-2015-5531 crg@fogheaven elasticpwn$ python CVE-2015-5531.py exploitlab.int /etc/hosts !dSR script for CVE-2015-5531 127.0.0.1 localhost The following lines are desirable for IPv6 capable hosts ::1 ip6-localhost ip6-loopback fe00::0...

ElasticSearch 1.7.2 Cloud-Azure Insecure Transit Vulnerability

The connection string for ELK cloud-azure plugin contains hardcoded http url with the lack of encryption and certificate validation, therefore it is prone to sniffing and MiTM attacks. A potential attacker with the required access to the network traffic would be able to intercept the content of t...

WS-2015-0054

Security vulnerability found in Elasticsearch before v5.0.0-alpha1. Failure to obtain a secure connection can occur due to issue within “accessClassInPackage.sun.security.ssl”...

ElasticSearch < 1.4.5 / < 1.5.2 - Path Transversal

No description provided by source. !/usr/bin/env python -- coding: UTF-8 -- import re from pocsuite.net import req from pocsuite.poc import Output, POCBase from pocsuite.utils import register class TestPOCPOCBase: vulID = '89268' version = '1' vulDate = '1431878400' createDate = '1442937600'...

Elasticsearch Logstash Security Bypass Vulnerability (CNVD-2015-05626)

Elasticsearch Logstash is a set of log analysis and monitoring tools from Elasticsearch Netherlands. The tool provides functions such as search, processing and management of logs or events. A security bypass vulnerability exists in Elasticsearch Logstash. An attacker can exploit this vulnerabilit...

CVE-2015-5531

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls...

Directory traversal

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls...

UBUNTU-CVE-2015-5531

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls...

CVE-2015-5531

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls...

CVE-2015-5531

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls...

CVE-2015-5531

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls...

CVE-2015-5531

Elasticsearch versions 1.0.0 through 1.6.0 are vulnerable to a directory traversal attack (CVE-2015-5531) due to insufficient validation of user-supplied paths during snapshot API calls. A remote, unauthenticated attacker can exploit this by sending crafted packets using traversal characters (e.g...

PT-2015-6976

Name of the Vulnerable Software and Affected Versions Elasticsearch versions prior to 1.6.1 Description The issue allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. This affects Elasticsearch, enabling attackers to access files they should not...

CVE-2015-5531: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls...

[SECURITY] Fedora 22 Update: elasticsearch-1.6.1-0.fc22

Elasticsearch is a search server based on Lucene. It provides a distributed, multitenant-capable full-text search engine with a RESTful web interface and schema-free JSON documents. Elasticsearch is developed in Java and is relea sed as open source under the terms of the Apache License. It is a...

Fedora Update for elasticsearch FEDORA-2015-12031

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...