4858 matches found
Elasticsearch ESA-2017-10
Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated...
Elasticsearch ESA-2018-11
A sensitive data disclosure flaw was found in the Elasticsearch repository-azure formerly elasticsearch-cloud-azure plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged. C Tenable Network Security, Inc. include"compat.inc"; if...
Elasticsearch ESA-2018-07
X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect XML canonicalization and DOM traversal. An attacker might have been able to impersonate a legitimate user if the SAML Identity Provider allows for self registration with arbitrary...
SUSE-SU-2018:2317-1 Security update for grafana, kafka, logstash, openstack-monasca-installer
This update for grafana, kafka, logstash, openstack-monasca-installer fixes the following issues: Security issues fixed: - CVE-2018-12099: grafana: Fix XSS vulnerabilities in dashboard links bsc1096985. - CVE-2018-3817: logstash: Fix inadvertently logging of sensitive information bsc1090849. Bug...
Design/Logic Flaw
A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the...
CVE-2017-12195
A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the...
CVE-2017-12195
A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the...
CVE-2017-12195
The CVE-2017-12195 vulnerability affects OpenShift platforms (OpenShift Container Platform/Enterprise) using the openshift elasticsearch plugin. Affected: OpenShift Enterprise/Container Platform 3.x with Elasticsearch; root cause is an authentication bypass where an attacker who knows the authent...
CVE-2017-12195
A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the...
CVE-2017-12195: Improper Authentication
A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the...
PT-2018-5382 · Red Hat · Openshift Enterprise
Name of the Vulnerable Software and Affected Versions: Openshift Enterprise versions affected versions not specified Description: A flaw was found in Openshift Enterprise that allows an attacker to bypass authentication and access Elasticsearch without a token, given they have knowledge of the na...
Elastic Elasticsearch Public WAN (Internet) / Public LAN Accessible
The script checks if the target host is running an Elastic Elasticsearch service accessible from a public WAN Internet / public LAN. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Aker - SSH Bastion/Jump Host/Jumpserver
Aker is a security tool that helps you configure your own Linux ssh jump/bastion host. Named after an Egyptian mythology deity who guarded the borders, Aker would act as choke point through which all your sysadmins and support staff access Linux production servers. Aker SSH gateway includes a lot...
Security Bulletin: Multiple security vulnerabilities in Elasticsearch might affect Process Federation Server in IBM Business Process Manager (BPM) - CVE-2015-5531, CVE-2015-5377
Summary IBM Process Federation Server is an optional component that is shipped with IBM Business Process Manager BPM V8.5.6.0. It allows the collection of task information of existing IBM Business Process Manager environments to provide a federated task list. IBM Process Federation Server uses th...
Moderate: Red Hat Bug Fix Advisory: OpenShift Container Platform 3.9 bug fix and enhancement update
Red Hat OpenShift Container Platform release 3.9.30 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud...
'Zip Slip' Vulnerability Affects Thousands of Projects Across Many Ecosystems
Security researchers at British software firm Snyk have revealed details of a critical vulnerability that affects thousands of projects across many ecosystems and can be exploited by attackers to achieve code execution on the target systems. Dubbed "Zip Slip," the issue is an arbitrary file...
File System Crawler: diskover
diskover is an open source file system crawler and disk space usage software that uses Elasticsearch to index and manage data across heterogeneous storage systems. Using diskover, you are able to more effectively search and organize files and system administrators are able to manage storage...
Diskover - File System Crawler, Storage Search Engine And Analytics Powered By Elasticsearch
diskover is an open source file system crawler and disk usage software that uses Elasticsearch to index and manage data across heterogeneous storage systems. Using diskover, you are able to more effectively search and organize files and system administrators are able to manage storage...
Sit-down with Wallarm CTO, Alex Golovko
I have had a chance to pose a few questions to Alexander Golovko, one of the co-founders of Wallarm and our CTO. Here are Alex’s reflections on Wallarm and some technology trends. How did Wallarm get its start? Ivan Wallarm’s founder has involved me in various projects on and off since 2010. By...