X-Pack Security 5.6.0 and 5.5.3 security update

X-Pack Security permission issue ESA-2017-18 An error was found in the X-Pack Security privilege enforcement. If a user has either ‘delete’ or ‘index’ permissions on an index in a cluster, they may be able to issue both delete and index requests against that index. Previously if a user had bulk...

melbourneflatpackkitchens.com.au XSS vulnerability

Vulnerable URL: http://www.melbourneflatpackkitchens.com.au/!prettyPhoto/0,%3Ca%20onclick=%22alert%27OPENBUGBOUNTY%27;%22%3E/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 10.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown...

FFmpeg 'mxf_read_primer_pack' function input validation vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A security vulnerability exists in the 'mxfreadprimerpack' function in the libavformat/mxfdec.c file in FFmpeg version 3.3.3. A remote attacker can exploit this vulnerability to bypass...

DEBIAN-CVE-2017-14169

In the mxfreadprimerpack function in libavformat/mxfdec.c in FFmpeg 3.3.3 - 2.4, an integer signedness error might occur when a crafted file, which claims a large "itemnum" field such as 0xffffffff, is provided. As a result, the variable "itemnum" turns negative, bypassing the check for a large...

August 2017 Preview of the Quality Rollups for the .NET Framework 2.0 SP2, 4.5.2, and 4.6 for Windows Server 2008 SP2: August 15, 2017

August 2017 Preview of the Quality Rollups for the .NET Framework 2.0 SP2, 4.5.2, and 4.6 for Windows Server 2008 SP2: August 15, 2017 View products that this article applies to. Summary This article lists the Quality Rollups for the .NET Framework 2.0 Service Pack 2 SP2, 4.5.2, and 4.6 for...

Unspecified vulnerability in Elasticsearch X-Pack Security TLS trust manager

Elasticsearch X-Pack is an extension of Elastic Stack log analysis system from the Dutch company Elasticsearch.Security TLS trust manager is one of the security certificate managers. A security vulnerability exists in Elasticsearch X-Pack Security TLS trust manager versions 5.0.0 through 5.5.1. N...

Elasticsearch X-Pack and Reporting Plugin Information Disclosure Vulnerability

Elasticsearch X-Pack is a Dutch Elasticsearch company Elastic Stack log analysis system extension. reporting is a plug-in application in which it can also be used independently. A security vulnerability exists in the Reporting feature in Elasticsearch X-Pack versions prior to 5.5.2 and Reporting...

CVE-2017-8445

An error was found in the X-Pack Security TLS trust manager for versions 5.0.0 to 5.5.1. If reloading the trust material fails the trust manager will be replaced with an instance that trusts all certificates. This could allow any node using any certificate to join a cluster. The proper behavior i...

CVE-2017-8446

The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reportinguser role could execute a report with the permissions of another reporting user, possibly gaining access to...

Security feature bypass

The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reportinguser role could execute a report with the permissions of another reporting user, possibly gaining access to...

CVE-2017-8446

The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reportinguser role could execute a report with the permissions of another reporting user, possibly gaining access to...

CVE-2017-8445

An error was found in the X-Pack Security TLS trust manager for versions 5.0.0 to 5.5.1. If reloading the trust material fails the trust manager will be replaced with an instance that trusts all certificates. This could allow any node using any certificate to join a cluster. The proper behavior i...

Design/Logic Flaw

An error was found in the X-Pack Security TLS trust manager for versions 5.0.0 to 5.5.1. If reloading the trust material fails the trust manager will be replaced with an instance that trusts all certificates. This could allow any node using any certificate to join a cluster. The proper behavior i...

CVE-2017-8446

The CVE-2017-8446 issue affects Elastic Kibana X-Pack: Reporting feature and standalone Reporting plugin prior to 5.5.2/2.4.6. The root cause is an impersonation flaw in the Reporting functionality, allowing a user with the reporting_user role to run a report with the permissions of another repor...

CVE-2017-8445

CVE-2017-8445 affects Elasticsearch X-Pack Security TLS trust manager in versions 5.0.0–5.5.1. If trust material reload fails, the trust manager can be replaced with an instance that trusts all certificates, potentially allowing any node using any certificate to join a cluster. The authenticated ...

CVE-2017-8445

An error was found in the X-Pack Security TLS trust manager for versions 5.0.0 to 5.5.1. If reloading the trust material fails the trust manager will be replaced with an instance that trusts all certificates. This could allow any node using any certificate to join a cluster. The proper behavior i...

CVE-2017-8446

The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reportinguser role could execute a report with the permissions of another reporting user, possibly gaining access to...

minidjvu denial of service vulnerability (CNVD-2017-25769)

minidjvu is a command-line utility for encoding and decoding single-page black-and-white DjVu files with the ability to compress multiple pages, taking advantage of similarities between pages. The mdjvubitmappackrow function denial of service vulnerability in base/4bitmap.c in Minidjvu allows an...

X-Pack Security 5.5.2 security update

X-Pack Security TLS certificate verification error ESA-2017-15 An error was found in the X-Pack Security TLS trust manager for versions 5.0.0 to 5.5.1. If reloading the trust material fails the trust manager will be replaced with an instance that trusts all certificates. This could allow any node...

Microsoft SQL Server Information Disclosure Vulnerability (KB4036996)

This host is missing an important security update according to Microsoft KB4036996. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...