GHSA-JCHW-25XP-JWWC vulnerabilities

Vulnerabilities for packages: lerna, kubeflow-centraldashboard, kubeflow-pipelines, configurable-http-proxy...

GHSA-JCHW-25XP-JWWC vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, kibana, configurable-http-proxy, lerna, arangodb, kubeflow-centraldashboard, opensearch-dashboards-fips, kubeflow-pipelines...

CVE-2023-26159 vulnerabilities

Vulnerabilities for packages: lerna, kubeflow-centraldashboard, kubeflow-pipelines, configurable-http-proxy...

CVE-2023-26159 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, kibana, configurable-http-proxy, lerna, arangodb, kubeflow-centraldashboard, opensearch-dashboards-fips, kubeflow-pipelines...

Expanded Coverage and AWS Compliance Pack Updates in InsightCloudSec Coming Out of AWS Re:Invent 2023

It seems like it was just yesterday that we were in Las Vegas for AWS Re:Invent, but it’s already been almost two weeks since the conference wrapped up. As is always the case, AWS unveiled a host of new services throughout the week, including advancements around serverless, artificial intelligenc...

PT-2023-9839 · Oracle · Peoplesoft Enterprise Peopletools

Name of the Vulnerable Software and Affected Versions: PeopleSoft Enterprise PeopleTools versions 8.59 through 8.61 Description: The issue exists due to insufficient input validation in the OpenSearch Dashboards component. It allows a remote attacker to gain unauthorized access to protected...

OpenSearch StackOverflow vulnerability

Impact A flaw was discovered in OpenSearch, affecting the search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. The issue was identified by Elastic Engineering and corresponds to security advisory ESA-2023-14 CVE-2023-31419...

com.ascentstream.pulsar:pulsar-io-elastic-search (>=2.10.6.9, <=3.0.8.0-snapshot-16a7bcc), com.erudika:para-search-elasticsearch (>=1.37.16, <=1.40.4) +64 more potentially affected by CVE-2023-31419 via org.opensearch:opensearch (>=1.0.0, <=1.3.13)

org.opensearch:opensearch MAVEN version =1.0.0, =2.10.6.9, =1.37.16, =1.1.8, =0.3.0, =0.0.43, =master-rc-daily, =1.0.0-1.16, =2.10.0, =3.3.9 - org.bedework.bw-cat:bw-category-impl 4.0.0 and more Source cves: CVE-2023-31419 Source advisory: GHSA-6G3J-P5G6-992F...

com.digitalpebble.stormcrawler:storm-crawler-opensearch (>=2.7, <=2.10), com.erudika:para-search-elasticsearch (1.40.5) +70 more potentially affected by unknown CVE via org.opensearch:opensearch (>=2.0.0, <=2.11.0)

org.opensearch:opensearch MAVEN version =2.0.0, =2.7, =3.0.3, =1.0.0-alpha, =1.0.0-alpha, =0.1.3, =0.1.3, =0.1.3, =0.1.2, =0.1.2, =0.1.2, =2.8.0.1, =0.5.0, =0.1.0, =0.1.0, =1.3.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-6G3J-P5G6-992F...

GHSA-6G3J-P5G6-992F OpenSearch StackOverflow vulnerability

Impact A flaw was discovered in OpenSearch, affecting the search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. The issue was identified by Elastic Engineering and corresponds to security advisory ESA-2023-14 CVE-2023-31419...

OpenSearch Improper Permissions Data Compromise

Vulnerability of the OpenSearch software package, related to improper storage of permissions. Exploiting this vulnerability can allow an attacker to compromise data integrity...

ROS-20231121-03

OpenSearch software package vulnerability related to improper permission saving. Exploitation exploitation of the vulnerability could allow an attacker to affect data integrity...

GHSA-WF5P-G6VW-RHXX vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

GHSA-WF5P-G6VW-RHXX vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, gitlab-rails-ce-fips, arangodb, opensearch-dashboards-fips, gitlab-rails-ce...

CVE-2023-45857 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, gitlab-rails-ce-fips, arangodb, opensearch-dashboards-fips, gitlab-rails-ce...

Denial Of Service (DoS)

OpenSearch is vulnerable to Denial of Service DoS. The vulnerability is due to improper input validation for malformed HTTP requests sent by an unauthenticated user in an opensearch node .This can leas to memory exhaustion resulting in to Denial of Service...

Improper Preservation Of Permissions

OpenSearch Security is vulnerable to Improper Preservation Of Permissions. The vulnerability exists in the isTenantAllowed function at PrivilegesInterceptorImpl.java which allows an attacker with read only access to create, edit, and delete operations on index metadata of dashboards...

GHSA-72Q2-GWWF-6HRV OpenSearch Issue with tenant read-only permissions

Impact There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them...

OpenSearch Issue with tenant read-only permissions

Impact There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them...

GHSA-8WX3-324G-W4QQ OpenSearch uncontrolled resource consumption

Impact An issue has been identified with how OpenSearch handled incoming requests on the HTTP layer. An unauthenticated user could force an OpenSearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering an...