CVE-2024-10241 Private channel names leaked with Ctrl+K when ElasticSearch is enabled

Mattermost versions 9.5.x = 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by using cmd+K/ctrl+K...

CVE-2024-10241 Private channel names leaked with Ctrl+K when ElasticSearch is enabled

Mattermost versions 9.5.x = 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by using cmd+K/ctrl+K...

CVE-2024-10241 Private channel names leaked with Ctrl+K when ElasticSearch is enabled

Mattermost versions 9.5.x = 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by using cmd+K/ctrl+K...

PT-2024-16133 · Mattermost +2 · Mattermost +2

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.9 Description: The issue arises when ElasticSearch is enabled, and Mattermost fails to properly filter channel data. This allows a user to obtain private channel names by using the cmd+K/ctrl+K shortcut...

Mattermost Server 9.5.x < 9.5.8 / 9.10.x < 9.10.1 (MMSA-2024-00359)

The version of Mattermost Server installed on the remote host is prior to 9.5.8 or 9.10.1. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00359 advisory. - Mattermost versions 9.5.x = 9.5.7 and 9.10.x = 9.10.0 fail to time limit and size limit the CA path file in the...

PT-2024-41371 · Elastic Nv · Elasticsearch

Уязвимость поисковой системы ElasticSearch связана с недостаточным ограничением попыток аутентификации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, реализовать атаку методом "грубой силы" brute force и повысить свои привилегии...

GHSA-735F-PC8J-V9W8 vulnerabilities

Vulnerabilities for packages: kafka, ruby3.3-fluentd-kubernetes-daemonset, elasticsearch, tez, confluent-kafka, apache-nifi, confluent-kafka-jre-bcfips, sonarqube-10, emsdk, ruby3.4-fluentd-kubernetes-daemonset, wavefront-proxy, hadoop-client-modules, hadoop-thirdparty,...

CVE-2024-7254 vulnerabilities

Vulnerabilities for packages: kafka, ruby3.3-fluentd-kubernetes-daemonset, elasticsearch, tez, confluent-kafka, apache-nifi, confluent-kafka-jre-bcfips, sonarqube-10, emsdk, ruby3.4-fluentd-kubernetes-daemonset, wavefront-proxy, hadoop-client-modules, hadoop-thirdparty,...

Security Bulletin: Vulnerabilities in Elasticsearch affect watsonx.data

Summary Elasticsearch is vulnerable to local authenticated attacks to obtain sensitive information and denial of service attacks. These can affect watsonx.data. Vulnerability Details CVEID:CVE-2023-31417 DESCRIPTION: Elasticsearch could allow a local authenticated attacker to obtain sensitive...

CVE-2024-37288

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in elasticsearch-7.10.2.jar

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of elasticsearch-7.10.2.jar Vulnerability Details CVEID:CVE-2023-31418 DESCRIPTION: Elastic Elasticsearch is vulnerable to a denial of service, caused by uncontrolled resource consumption. By sending a moderate...

Security Bulletin: Vulnerability in Elastic Elasticsearch-Hadoop affects watsonx.data

Summary Elastic Elasticsearch-Hadoop could allow the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. As this occurs when the user has been authenticated, there is limited impact to watsonx.data. Vulnerabili...

PT-2024-5984 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana affected versions not specified Description: A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious us...

Security Bulletin: Vulnerabilities in Elasticsearch affect watsonx.data

Summary Elasticsearch is vulnerable to local authenticated attacks to obtain sensitive information and denial of service attacks. These can affect watsonx.data. Vulnerability Details CVEID:CVE-2023-31417 DESCRIPTION: Elasticsearch could allow a local authenticated attacker to obtain sensitive...

Elasticsearch Memory Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Elasticsearch Memory Disclosure', 'Description' = %q This module exploits a memory disclosure vulnerability in Elasticsearch 7.10.0 to 7.13.3...

Path Traversal

github.com/mattermost/mattermost-server is vulnerable to Path Traversal. The vulnerability is due to improper input validation of the CA path file in the Elasticsearch configuration due to a lack of proper sanitization and validation. This allows an attacker to provide a malicious path, such as...

Mattermost Denial of Service Vulnerability (CNVD-2025-12774)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a denial-of-service vulnerability that stems from a failure to time and size limit CA path files in the ElasticSearch configuration, which can be exploited by an attacker to add...

CVE-2024-39810

Mattermost versions 9.5.x = 9.5.7 and 9.10.x = 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuration which allows a System Role with access to the Elasticsearch system console to add any file as a CA path field, such as /dev/zero and, after testing the...

CVE-2024-39810 Server crash via Elasticsearch certificate file

Mattermost versions 9.5.x = 9.5.7 and 9.10.x = 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuration which allows a System Role with access to the Elasticsearch system console to add any file as a CA path field, such as /dev/zero and, after testing the...

CVE-2024-39810 Server crash via Elasticsearch certificate file

Mattermost versions 9.5.x = 9.5.7 and 9.10.x = 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuration which allows a System Role with access to the Elasticsearch system console to add any file as a CA path field, such as /dev/zero and, after testing the...