1239 matches found
PT-2022-20539
Name of the Vulnerable Software and Affected Versions opensearch-ruby versions prior to 2.0.1 Description The issue is related to the use of the ruby YAML.load function instead of YAML.safe load in opensearch-ruby, which can lead to unsafe deserialization using YAML.load if the response is of typ...
CVE-2022-31115: Deserialization of Untrusted Data
opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby YAML.load function was used instead of YAML.safeload. As a result opensearch-ruby 2.0.0 and prior can lead to unsafe deserialization using YAML.load if the response is of type YAML. ...
FreeBSD : OpenSearch -- Log4Shell (d1be3d73-6737-11ec-9eea-589cfc007716)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the d1be3d73-6737-11ec-9eea-589cfc007716 advisory. - Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 did not protect from uncontrolled...
FreeBSD : OpenSearch -- Log4Shell (b0f49cb9-6736-11ec-9eea-589cfc007716)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b0f49cb9-6736-11ec-9eea-589cfc007716 advisory. - It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain...
OpenSearch -- Log4Shell
OpenSearch reports: CVE-2021-45105 for Log4j was issued after the release of OpenSearch 1.2.2. This CVE advises upgrading to Log4j 2.17.0. While there has been no observed reproduction of the issue described in CVE-2021-45105 in OpenSearch, we have released OpenSearch 1.2.3 which updates Log4j to...
OpenSearch -- Log4Shell
OpenSearch reports: CVE-2021-45046 was issued shortly following the release of OpenSearch 1.2.1. This new CVE advises upgrading from Log4j 2.15.0 used in OpenSearch 1.2.1 to Log4j 2.16.0. Out of an abundance of caution, the team is releasing OpenSearch 1.2.2 which includes Log4j 2.16.0. While the...
Privilege Escalation
github.com/opensearch-project/opensearch-cli is vulnerable to Privilege Escalation. The vulnerability exists due to the weak file path permission in the configuration file, allowing an attacker to read or write any file on the file path...
FreeBSD : OpenSearch -- Log4Shell (4b1ac5a3-5bd4-11ec-8602-589cfc007716)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4b1ac5a3-5bd4-11ec-8602-589cfc007716 advisory. - Apache Log4j2 2.10 this behavior can be mitigated by setting system property log4j2.formatMsgNoLookup...
CVE-2021-44833
The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file...
CVE-2021-44833
The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file...
Design/Logic Flaw
The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file...
CVE-2021-44833
The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file...
CVE-2021-44833
The CVE-2021-44833 entry affects the OpenSearch CLI 1.0.0 for Amazon OpenSearch, with weak permissions on the configuration file. The issue is described as a file‑permission weakness that can expose or alter configuration data, contributing to HIGH impact across confidentiality, integrity, and av...
CVE-2021-44833
The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file...
OpenSearch Web browser 安全漏洞
OpenSearch Web browser is a Web browser. openSearch Web browser 1.0.0 has a security vulnerability that stems from the application's weak permissions on configuration files. No detailed vulnerability details are currently available...
PT-2021-24158
Name of the Vulnerable Software and Affected Versions: Amazon AWS OpenSearch CLI version 1.0.0 Description: The issue concerns weak permissions for the configuration file in the CLI for Amazon AWS OpenSearch. Recommendations: For Amazon AWS OpenSearch CLI version 1.0.0, consider restricting acces...
CVE-2021-44833: Incorrect Default Permissions
The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file...
OpenSearch -- Log4Shell
OpenSearch reports: A recently published security issue CVE-2021-44228 affects several versions of the broadly-used Apache Log4j library. Some software in the OpenSearch project includes versions of Log4j referenced in this CVE. While, at time of writing, the team has not found a reproduceable...