Elasticsearch Kibana Cross-Site Scripting Vulnerability

Elasticsearch Kibana is a suite of open source, browser-based tools for analyzing and searching Elasticsearch dashboards. A cross-site scripting vulnerability exists in Elasticsearch Kibana, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which...

SearchBlox 8.2 Cross Site Scripting

Advisory ID: HTB23256 Product: SearchBlox Vendor: SearchBlox Software, Inc. Vulnerable Versions: 8.2 and probably prior Tested Version: 8.2 Advisory Publication: April 22, 2015 without technical details Vendor Notification: April 22, 2015 Vendor Patch: May 26, 2015 Public Disclosure: June 17, 201...

Elasticsearch Logstash File Output Plugin Directory Traversal Vulnerability

Elasticsearch Logstash is a set of log analysis and monitoring tools. The tool provides features such as search, processing and management of logs or events. A directory traversal vulnerability in the file output plugin for Elasticsearch Logstash allows remote attackers to write arbitrary files t...

Elasticsearch RCE

Remote command execution vulnerability in Elasticsearch Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

CVE-2015-4152

Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option...

CVE-2015-4093

Cross-site scripting XSS vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Directory traversal

Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option...

Cross site scripting

Cross-site scripting XSS vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4152

CVE-2015-4152 describes a directory traversal vulnerability in the Elasticsearch Logstash file output plugin prior to 1.4.3. The issue arises from dynamic field references in the path option, enabling remote attackers to write to arbitrary files with the privileges of the Logstash user. Public so...

CVE-2015-4093

Cross-site scripting XSS vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4152

Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option...

CVE-2015-4093

Cross-site scripting XSS vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4093

Elasticsearch Kibana 4.x prior to 4.0.3 is vulnerable to cross-site scripting (XSS). The vulnerability is described as allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. Affected product is Kibana 4.x; the issue stems from an XSS flaw in versions before 4.0....

CVE-2015-4152: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option...

CVE-2015-4093: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2015-6433

Name of the Vulnerable Software and Affected Versions Elasticsearch Logstash versions prior to 1.4.3 Description A directory traversal issue exists in the file output plugin, allowing remote attackers to write to arbitrary files through dynamic field references in the path option. Recommendations...

Elasticsearch files access

snapshot API files access...

Elasticsearch vulnerability CVE-2015-4165

Summary: Elasticsearch versions 1.0.0 - 1.5.2 are vulnerable to an engineered attack on other applications on the system. The snapshot API may be used indirectly to place snapshot metadata files into locations that are writeable by the user running the Elasticsearch process. It is possible to...

Elasticsearch 1.5.2 File Creation Vulnerability

Elasticsearch versions 1.0.0 through 1.5.2 are vulnerable to an engineered attack on other applications on the system. The snapshot API may be used indirectly to place snapshot metadata files into locations that are writeable by the user running the Elasticsearch process. It is possible to create...

Elasticsearch Engineered Attack Vulnerability CVE-2015-4165

Summary: Elasticsearch versions 1.0.0 - 1.5.2 are vulnerable to an engineered attack on other applications on the system. The snapshot API may be used indirectly to place snapshot metadata files into locations that are writeable by the user running the Elasticsearch process. It is possible to...