K000163487: OpenShift vulnerabilities CVE-2017-12195, CVE-2017-15137, and CVE-2017-15138

Security Advisory Description CVE-2017-12195 A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication...

ROOT-APP-MAVEN-CVE-2025-68390 CVE-2025-68390 in io.root.org.elasticsearch.plugin:x-pack-core - Patched by Root

Root has patched CVE-2025-68390 in the io.root.org.elasticsearch.plugin:x-pack-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-68384 CVE-2025-68384 in io.root.org.elasticsearch.plugin:x-pack-security - Patched by Root

Root has patched CVE-2025-68384 in the io.root.org.elasticsearch.plugin:x-pack-security package for Root:Maven. Multiple fixed versions available...

EUVD-2025-209573

Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string. This occurs in the 'search site' feature when using the Elasticsearch7 search plugin. The Elasticsearch function does not properly sanitize input in the query paramete...

CVE-2022-38299

An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via the PKI realm. An attacker can impersonate other users by presenting specially crafted client certificates signed by a trusted Certificate Authority. Note: This is only exploitable if the attacker...

Fluent Bit Plugin Information Disclosure

The vulnerability of plugins inhttp, insplunk, and inelasticsearch, which are tools for collecting and processing logs with Fluent Bit, is related to improper type checking of input data when processing the tagkey parameter. Exploitation of this vulnerability can allow an attacker to disclose and...

CVE-2025-12977

Fluent Bit inhttp, insplunk, and inelasticsearch input plugins fail to sanitize tagkey inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tagkey values containing special characters such as newlines or ../ that are treated as valid tags...

CVE-2025-12977 CVE-2025-12977

Fluent Bit inhttp, insplunk, and inelasticsearch input plugins fail to sanitize tagkey inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tagkey values containing special characters such as newlines or ../ that are treated as valid tags...

EUVD-2018-15614

Malware in sbrugna...

EUVD-2022-40891

Malicious code in bioql PyPI...

EUVD-2024-51440

Malicious code in bioql PyPI...

CVE-2024-13221

The Fantastic ElasticSearch WordPress plugin through 4.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2022-34807

Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

de.spinscale:elasticsearch-plugin-suggest (0.19.12-0.2) potentially affected by CVE-2024-52979 via org.elasticsearch:elasticsearch (0.19.12)

org.elasticsearch:elasticsearch MAVEN version 0.19.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - de.spinscale:elasticsearch-plugin-suggest 0.19.12-0.2 Source cves: CVE-2024-52979 Source...

com.sonian:elasticsearch-equilibrium (0.20.0), com.sonian:elasticsearch-jetty (>=0.20.0, <=0.20.1) +2 more potentially affected by CVE-2024-52979 via org.elasticsearch:elasticsearch (0.20.2)

org.elasticsearch:elasticsearch MAVEN version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.sonian:elasticsearch-equilibrium 0.20.0 - com.sonian:elasticsearch-jetty =0.20.0, =0.20.2-0....

CVE-2024-13221

The Fantastic ElasticSearch WordPress plugin through 4.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13221

The Fantastic ElasticSearch WordPress plugin in versions 4.1.0 and earlier is vulnerable to a Reflected Cross-Site Scripting (XSS) issue. The root cause is the failure to properly sanitise and escape a parameter before it is outputted back onto the page. An attacker could exploit this by tricking...

CVE-2024-13221 Fantastic Elasticsearch <= 4.1.0 - Reflected XSS

The Fantastic ElasticSearch WordPress plugin through 4.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

de.spinscale:elasticsearch-plugin-suggest (0.19.11-0.1) potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (0.19.11)

org.elasticsearch:elasticsearch MAVEN version 0.19.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - de.spinscale:elasticsearch-plugin-suggest 0.19.11-0.1 Source cves: CVE-2024-43709 Source...