42 matches found
ElasticSearch <1.6.1 - Local File Inclusion
ElasticSearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. id: CVE-2015-5531 info: name: ElasticSearch 1.6.1 - Local File Inclusion author: princechaddha severity: medium description: ElasticSearch before 1.6.1 allows remote...
CVE-2015-5531-POC
CVE-2015-5531-POC Contexto de la vulnerabilidad Elasticsearch es un motor de búsqueda RESTful distribuido y de código abierto basado en Lucene, desarrollado por la empresa neerlandesa Elasticsearch. Se utiliza principalmente en entornos de computación en la nube y permite indexar datos mediante...
grafana: Grafana: Unauthorized snapshot deletion via Broken Access Control in Snapshot API
A flaw was found in Grafana. An authenticated user with editor privileges could exploit a Broken Access Control BAC vulnerability in the Snapshot API. This flaw allows an editor to delete any dashboard snapshot, even those they do not have explicit read or write access to, leading to unauthorized...
grafana: Grafana: Unauthorized snapshot deletion via Broken Access Control in Snapshot API
A flaw was found in Grafana. An authenticated user with editor privileges could exploit a Broken Access Control BAC vulnerability in the Snapshot API. This flaw allows an editor to delete any dashboard snapshot, even those they do not have explicit read or write access to, leading to unauthorized...
grafana: Grafana: Unauthorized snapshot deletion via Broken Access Control in Snapshot API
A flaw was found in Grafana. An authenticated user with editor privileges could exploit a Broken Access Control BAC vulnerability in the Snapshot API. This flaw allows an editor to delete any dashboard snapshot, even those they do not have explicit read or write access to, leading to unauthorized...
ROS-20260708-73-0027
The vulnerability of the Snapshot API interface of the Grafana monitoring and observation platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain access to read and delete data...
CVE-2026-28380 BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
Any Editor could delete any snapshot, even if they have no access to read or write them...
Authorization Bypass Through User-Controlled Key
Overview github.com/grafana/grafana/pkg/api is an open and composable observability and data visualization platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the Snapshot API process. An attacker can remove dashboard snapshots without...
CVE-2026-28380 BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
Any Editor could delete any snapshot, even if they have no access to read or write them...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the Snapshot API process. An attacker can remove dashboard snapshots without proper authorization by sending crafted requests as an authenticated user with editor privileges. Remediati...
EUVD-2018-15613
Malware in sbrugna...
EUVD-2022-3784
Malicious code in bioql PyPI...
VulnCheck KEV: CVE-2015-5531
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls...
CVE-2024-3078
A vulnerability was found in Qdrant up to 1.6.1/1.7.4/1.8.2 and classified as critical. This issue affects some unknown processing of the file lib/collection/src/collection/snapshots.rs of the component Full Snapshot REST API. The manipulation leads to path traversal. Upgrading to version 1.8.3 i...
Qdrant 路径遍历漏洞
Qdrant is a vector similarity search engine and vector database. A path traversal vulnerability exists in Qdrant, which stems from a path traversal vulnerability in the component Full Snapshot REST API. Affected products and versions: Qdrant 1.6.1 and earlier, 1.7.4 and earlier, 1.8.2 and earlier...
GHSA-FH5X-4J57-6Q5X Improper Access Control in Elasticsearch
The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and...
Improper Access Control in Elasticsearch
The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and...
Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls...
GHSA-JJQ8-VFJQ-J6V4 Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls...
