UBUNTU-CVE-2014-6439

Cross-site scripting XSS vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-6439

Cross-site scripting XSS vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-6439

Cross-site scripting XSS vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-6439

Cross-site scripting XSS vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-6439

The CVE-2014-6439 entry tracks a Cross-site Scripting (XSS) vulnerability in the CORS functionality of Elasticsearch prior to 1.4.0.Beta1. The issue could allow remote attackers to inject arbitrary script/HTML via unspecified vectors. Public references confirm this XSS surface is tied to Elastics...

PT-2014-7220

Name of the Vulnerable Software and Affected Versions Elasticsearch versions prior to 1.4.0.Beta1 Description A cross-site scripting XSS issue exists in the CORS functionality, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For versions...

CVE-2014-6439: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Elasticsearch vulnerability CVE-2014-6439

Summary: Elasticsearch versions 1.3.x and prior have a default configuration for CORS that allows an attacker to craft links that could cause a user’s browser to send requests to Elasticsearch instances on their local network. These requests could cause data loss or compromise. We have been...

elasticsearch weak CORS policy

Crossite requests to local network are possible...

elasticsearch -- cross site scripting vulnerability in the CORS functionality

Elastic reports: Vulnerability Summary: Elasticsearch versions 1.3.x and prior have a default configuration for CORS that allows an attacker to craft links that could cause a user's browser to send requests to Elasticsearch instances on their local network. These requests could cause data loss or...

RHEL 6 : katello-configure (RHSA-2014:1186)

An updated katello-configure package that fixes one security issue is now available for Red Hat Subscription Asset Manager. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Important: Red Hat Security Advisory: katello-configure security update

An updated katello-configure package that fixes one security issue is now available for Red Hat Subscription Asset Manager. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

elasticsearch: remote code execution flaw via dynamic scripting

It was discovered that the default configuration of Elasticsearch enabled dynamic scripting, allowing a remote attacker to execute arbitrary MVEL expressions and Java code via the source parameter passed to search...

Important: Red Hat Security Advisory: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update

This advisory contains instructions on how to resolve one security issue in the Elasticsearch component in Fuse ESB Enterprise and Fuse MQ Enterprise 7.1.0. Red Hat Product Security has rated this security issue as having Important security impact. A Common Vulnerability Scoring System CVSS base...

elasticsearch: remote code execution flaw via dynamic scripting

It was discovered that the default configuration of Elasticsearch enabled dynamic scripting, allowing a remote attacker to execute arbitrary MVEL expressions and Java code via the source parameter passed to search...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.1.0 security update

This advisory contains instructions on how to resolve one security issue in the Elasticsearch component in Red Hat JBoss Fuse and A-MQ 6.1.0. Red Hat Product Security has rated this security issue as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which...

elasticsearch: remote code execution flaw via dynamic scripting

It was discovered that the default configuration of Elasticsearch enabled dynamic scripting, allowing a remote attacker to execute arbitrary MVEL expressions and Java code via the source parameter passed to search...

Mail.ru: Не уверен, что этому место на периметре: 94.100.180.95, 94.100.180.96, 94.100.180.97, 94.100.180.98

Там торчит вебка Elastisearch, явно для внутренних нужд...

Distributed Packet Monitoring System: Packetbeat

Packetbeat is a distributed packet monitoring system that can be used for application performance management. Think of it like a distributed real-time Wireshark with a lot more analytics features. Agents sniff the traffic between your application processes, parse on the fly protocols like HTTP,...