Cyber Security firm exposes 5 billion+ login credentials

By Deeba Ahmed On 16th March an Elasticsearch database reportedly owned by the UK-based cyber security firm Keepnet Labs... This is a post from HackRead.com Read the original post: Cyber Security firm exposes 5 billion+ login credentials...

elasticsearch: Improper permission issue when attaching a new name to an index

A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the aliases, shrink, or split endpoints are used . If the elasticsearch.yml file has xpack.security.dlsfls.enabled set to false, certain permission...

elasticsearch: Improper permission issue when attaching a new name to an index

A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the aliases, shrink, or split endpoints are used . If the elasticsearch.yml file has xpack.security.dlsfls.enabled set to false, certain permission...

Moderate: Red Hat Security Advisory: Red Hat Process Automation Manager 7.7.0 Security Update

An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

CVE-2019-7619

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm...

Mahara 18.10 < 18.10.5, 19.04 < 19.04.4, 19.10 < 19.10.2 Multiple Vulnerabilities

Mahara is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mahara:mahara"; if description...

Mahara Information Disclosure Vulnerability (CNVD-2020-16699)

Mahara is a full-featured web application for building your own ePortfolio. An information disclosure vulnerability exists in Mahara. The vulnerability can be exploited by a member of a group to gain unauthorized access to file metadata information in an Elasticsearch results list. No detailed...

CVE-2020-9386

In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in the Elasticsearch result list despite them not having access to that artefact anymore...

CVE-2020-9386

In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in the Elasticsearch result list despite them not having access to that artefact anymore...

CVE-2020-9386

In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in the Elasticsearch result list despite them not having access to that artefact anymore...

Information disclosure

In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in the Elasticsearch result list despite them not having access to that artefact anymore...

CVE-2020-9386

In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in the Elasticsearch result list despite them not having access to that artefact anymore...

CVE-2020-9386

The CVE-2020-9386 issue affects Mahara: versions 18.10.x before 18.10.5, 19.04.x before 19.04.4, and 19.10.x before 19.10.2. Root cause is improper access-control enforcement, causing file metadata to be disclosed to group members who no longer have access to the artefact in Elasticsearch result ...

CVE-2020-9386: Exposure of Sensitive Information to an Unauthorized Actor

In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in the Elasticsearch result list despite them not having access to that artefact anymore...

SUSE SLES12 Security Update : python-aws-sam-translator, python-boto3, python-botocore, python-cfn-lint, python-jsonschema, python-nose2, python-parameterized, python-pathlib2, python-pytest-cov, python-requests, python-s3transfer (SUSE-SU-2020:0555-1)

This update for python-aws-sam-translator, python-boto3, python-botocore, python-cfn-lint, python-jsonschema, python-nose2, python-parameterized, python-pathlib2, python-pytest-cov, python-requests, python-s3transfer, python-jsonpatch, python-jsonpointer, python-scandir, python-PyYAML fixes the...

Critical Photon OS Security Update - PHSA-2020-0281

Updates of 'envoy', 'ncurses', 'unzip' packages of Photon OS have been released...

cateye (0.3.8), protean (>=0.0.3, <=0.0.5) +5 more potentially affected by CVE-2020-6802 via bleach (2.1.3)

bleach PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - cateye 0.3.8 - protean =0.0.3, =0.4.2, =0.0.1, =0.1.0, =0.2.4 Source cves: CVE-2020-6802 Source advisory: OSV:GHSA-Q65M-PV3F-WR5R...

com.twitter:ostrich (2.3.0), com.twitter:ostrich_2.8.0 (>=2.2.6, <=2.2.10) +8 more potentially affected by CVE-2019-20444 via org.jboss.netty:netty (3.1.5.ga)

org.jboss.netty:netty MAVEN version 3.1.5.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.netty:netty and may be impacted: - com.twitter:ostrich 2.3.0 - com.twitter:ostrich2.8.0 =2.2.6, =2.2.11, =1.3.0, =1.3.2, =1.3.4 Source cves:...

com.twitter:ostrich (2.3.0), com.twitter:ostrich_2.8.0 (>=2.2.6, <=2.2.10) +8 more potentially affected by CVE-2019-20445 via org.jboss.netty:netty (3.1.5.ga)

org.jboss.netty:netty MAVEN version 3.1.5.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.netty:netty and may be impacted: - com.twitter:ostrich 2.3.0 - com.twitter:ostrich2.8.0 =2.2.6, =2.2.11, =1.3.0, =1.3.2, =1.3.4 Source cves:...

Elasticsearch Kibana CSV Injection Vulnerability

Elasticsearch Kibana is a suite of open source, browser-based analytics and search Elasticsearch dashboard tools from Elasticsearch Netherlands. A CSV injection vulnerability exists in Elasticsearch Kibana. An attacker can exploit the vulnerability to run malicious commands on a logged-in user's...