Design/Logic Flaw

In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be...

CVE-2017-8443

In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be...

CVE-2017-8443

CVE-2017-8443 affects Elastic Kibana X-Pack security prior to 5.4.3. A crafted Kibana URL can redirect to an improperly initialized login screen, causing credentials entered there to appear in the URL bar and potentially be viewed by others or logged. Remediation: upgrade to Kibana X-Pack 5.4.3 o...

The vulnerabilities of the Microsoft Office suite of programs, the Microsoft OneNote note-taking software, the Microsoft Word text editor, the Office Web Apps Server network software, the Microsoft SharePoint Server network software, the Microsoft Office Web Apps suite of programs, and the Microsoft Office Compatibility Pack allow a perpetrator to execute arbitrary code.

Vulnerabilities of the Microsoft Office suite of programs, the Microsoft OneNote note-taking software, the Microsoft Word text editor, the Office Web Apps Server web application, the Microsoft SharePoint Server web application, and the Microsoft Office Web Apps suite are related to improper acces...

libmtp ptp-pack.c file integer overflow vulnerability

libmtp is an LGPL library for the Media Transport Protocol. An integer overflow vulnerability exists in the ptp-pack.c file in libmtp 1.1.12 and earlier. A remote attacker could exploit this vulnerability by plugging a mobile device into a PC via the USB port to cause a denial of service...

IBM DB2 Connect 9.7 < FP11 Special Build 36621 / 10.1 < FP6 Special Build 36610 / 10.5 < FP8 Special Build 36605 / 11.1.2 < FP2 Multiple Vulnerabilities (Windows)

According to its version, the installation of IBM DB2 Connect on the remote Windows host is either 9.7 prior to Fix Pack 11 Special Build 36621, 10.1 prior to Fix Pack 6 Special Build 36610, 10.5 prior to Fix Pack 8 Special Build 36605, or 11.1.2 prior to Fix Pack 2. It is, therefore, affected by...

May 2017 Preview of the Quality Rollups for the .NET Framework 2.0 Service Pack 2, 4.5.2, and 4.6 for Windows Server 2008 Service Pack 2 (KB4019291): May 16, 2017

May 2017 Preview of the Quality Rollups for the .NET Framework 2.0 Service Pack 2, 4.5.2, and 4.6 for Windows Server 2008 Service Pack 2 KB4019291: May 16, 2017 Notice This release has been removed from Windows Update because of the issues that are described in the following .NET Blog article: .N...

Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities

Exploit for linux platform in category web applications 1. Advisory Information Title: Kaspersky Anti-Virus File Server Multiple Vulnerabilities Advisory ID: CORE-2017-0003 Advisory URL: http://www.coresecurity.com/advisories/Kaspersky-Anti-Virus-File-Server-Multiple-Vulnerabilities Date publishe...

Flat Assembler 1.7.21 - Local Buffer Overflow

Flat Assembler 1.7.21 - Local Buffer Overflow !/usr/bin/python Developed using Exploit Pack - http://exploitpack.com - Exploit Author: Juan Sacco at KPN Red Team - http://www.kpn.com Tested on: GNU/Linux - Kali 2017.1 Release What is FASM? Flat assembler is a fast, self-compilable assembly langua...

Elastic Stack 5.4.3 Security update

Kibana X-Pack Security user credentials disclosure ESA-2017-11 In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the...

JAD Java Decompiler 1.5.8e - Local Buffer Overflow (NX Enabled)

JAD Java Decompiler 1.5.8e - Local Buffer Overflow NX Enabled !/usr/bin/python Exploit Author: Juan Sacco at KPN Red Team - http://www.kpn.com Developed using Exploit Pack - http://exploitpack.com - Tested on: GNU/Linux - Kali 2017.1 Release Description: JAD Java Decompiler 1.5.8e-1kali1 and prio...

CVE-2017-3743

If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility ASU, UpdateXpress System Pack Installer UXSPI or Dynamic System Analysis DSA to a second machine, the other users may be able to see the user ID...

Command injection

If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility ASU, UpdateXpress System Pack Installer UXSPI or Dynamic System Analysis DSA to a second machine, the other users may be able to see the user ID...

Open Redirect Attack

Kibana is vulnerable to open redirect attacks. When X-Pack is installed, attackers are able to craft a link through the login page that redirects to an arbitrary website...

Privilege Bypass

Kibana is vulnerable to privilege bypass attacks. When X-Pack is installed, requests to the short URL and advanced settings services. This flaw allows authenticated users to make requests to those services regardless of their own permissions...

ElasticSearch X-Pack security information disclosure vulnerability (CNVD-2017-15509)

ElasticSearch X-Pack is an extension of the Elastic Stack log analysis system from the Dutch company Elasticsearch. security is one of the features used to control access rights. ElasticSearch X-Pack security has an information disclosure vulnerability. Allow attackers to exploit the vulnerabilit...

CVE-2017-8449

X-Pack Security 5.2.x would allow access to more fields than the user should have seen if the field level security rules used a mix of grant and exclude rules when merging multiple rules with field level security rules for the same index...

Code injection

With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authenticated user could make requests to those services regardless of their own permissions...

CVE-2017-8450

X-Pack 5.1.1 did not properly apply document and field level security to multi-search and multi-get requests so users without access to a document and/or field may have been able to access this information...

Design/Logic Flaw

X-Pack Security 5.2.x would allow access to more fields than the user should have seen if the field level security rules used a mix of grant and exclude rules when merging multiple rules with field level security rules for the same index...