CVE-2020-7014: Incorrect Privilege Assignment

The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication...

CVE-2020-7010: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

Elastic Cloud on Kubernetes ECK versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK...

org.jooby:coverage-report (0.7.0), org.jooby:jooby-aws (0.7.0) +23 more potentially affected by CVE-2020-7647 via org.jooby:jooby (0.7.0)

org.jooby:jooby MAVEN version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jooby:jooby and may be impacted: - org.jooby:coverage-report 0.7.0 - org.jooby:jooby-aws 0.7.0 - org.jooby:jooby-camel 0.7.0 - org.jooby:jooby-commons-email 0.7.0 -...

Photon OS 3.0: Elasticsearch PHSA-2020-3.0-0088

An update of the elasticsearch package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0088. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid136577;...

Important Photon OS Security Update - PHSA-2020-0088

Updates of 'kibana', 'docker', 'elasticsearch' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2020-3.0-0088

Updates of 'docker', 'kibana', 'elasticsearch' packages of Photon OS have been released...

FreeBSD : Gitlab -- Multiple Vulnerabilities (e8483115-8b8e-11ea-bdcf-001b217b3468)

Gitlab reports : Path Traversal in NuGet Package Registry Workhorse Bypass Leads to File Disclosure OAuth Application Client Secrets Revealed Code Owners Approval Rules Are Not Updated for Existing Merge Requests When Source Branch Changes Code Owners Protection Not Enforced from Web UI Repositor...

CVE-2020-9387

In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not accessible when the config setting 'Isolated institutions' is turned on...

CVE-2020-9387

In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not accessible when the config setting 'Isolated institutions' is turned on...

CVE-2020-9387

In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not accessible when the config setting 'Isolated institutions' is turned on...

CVE-2020-9387

In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not accessible when the config setting 'Isolated institutions' is turned on...

Design/Logic Flaw

In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not accessible when the config setting 'Isolated institutions' is turned on...

CVE-2020-9387

CVE-2020-9387 affects Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3. The issue exposes account details in Elasticsearch results for accounts that should be inaccessible when the Isolated institutions setting is enabled, resulting in information disclosure. The vulnerability’s concrete reme...

CVE-2020-9387

In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not accessible when the config setting 'Isolated institutions' is turned on...

CVE-2020-9387

In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not accessible when the config setting 'Isolated institutions' is turned on...

CVE-2020-9387: Exposure of Sensitive Information to an Unauthorized Actor

In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not accessible when the config setting 'Isolated institutions' is turned on...

PT-2020-20628

Name of the Vulnerable Software and Affected Versions Mahara versions 19.04 through 19.04.4 Mahara versions 19.10 through 19.10.2 Description The issue concerns the sharing of account details in Elasticsearch results for accounts that are not accessible. This occurs when the config setting...

Insecure Random Number Generator

github.com/elastic/cloud-on-k8s uses an insecure random number generator. Passwords are generated using an insecure random number generator, which would allow an attacker to easily brute-force and discover the Elasticsearch credentials generated by ECK...

Malicious Package

Overview awselasticsearch is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

CVE-2020-7009

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...