1800 matches found
Elasticsearch 7.10.0-7.13.3 - Information Disclosure
ElasticSsarch 7.10.0 to 7.13.3 is susceptible to information disclosure. A user with the ability to submit arbitrary queries can submit a malformed query that results in an error message containing previously used portions of a data buffer. This buffer can contain sensitive information such as...
Kibana - Local File Inclusion
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with...
CVE-2026-56152
Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to vie...
EUVD-2026-41087
Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to vie...
CVE-2026-56152
Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to vie...
CVE-2026-56152 Incorrect Authorization in Elastic Defend Leading to Information Disclosure
Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to vie...
CVE-2026-56152
Summary: CVE-2026-56152 concerns Elastic Defend. Affected component is the Elastic Defend response actions where an authorization check failure allowed a low-privileged authenticated user to access response action data they should not view (CWE-863, CAPEC-1). Impact details (as described): The vu...
GHSA-PJV4-3C63-699F vulnerabilities
Vulnerabilities for packages: elastic-agent-fips, elastic-agent...
CVE-2026-42602 vulnerabilities
Vulnerabilities for packages: elastic-agent-fips, elastic-agent...
PT-2026-54867
Name of the Vulnerable Software and Affected Versions Elastic Defend affected versions not specified Description Incorrect authorization allows a low-privileged authenticated user to access response action data they are not authorized to view. This occurs because functionality is not properly...
CVE-2023-49922 vulnerabilities
Vulnerabilities for packages: elastic-agent-fips, apm-server-fips, cloudbeat, apm-server, cloudbeat-fips, elastic-agent...
GHSA-HJ4R-2C9C-29H3 vulnerabilities
Vulnerabilities for packages: elastic-agent-fips, apm-server-fips, cloudbeat, apm-server, cloudbeat-fips, elastic-agent...
CVE-2026-48496 vulnerabilities
Vulnerabilities for packages: elastic-agent-fips, elastic-agent...
GHSA-F2R5-5M7W-P5CX vulnerabilities
Vulnerabilities for packages: elastic-agent-fips, elastic-agent...
GHSA-45GG-VH54-H5M9 vulnerabilities
Vulnerabilities for packages: zarf-fips, harbor, osv-scanner, rancher, knative-eventing-fips, spire-server, k9s-fips, argocd-image-updater, vitess, docker-machine-driver-harvester, trivy-fips, cloudbeat, mattermost, prometheus-mongodb-exporter, flux-image-automation-controller-fips, snyk-cli,...
CVE-2026-40012
The vulnerability CVE-2026-40012 affects configurations with ECS enabled, where ECS zero-scoped answers are stored in the packet cache instead of being properly restricted, potentially leaking to clients. The issue has a network-based attack surface with low confidentiality impact (CVSS v3.1: 5.3...
EUVD-2026-39356
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;...
CVE-2026-40012
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;...
CVE-2026-40012
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;...
CVE-2026-57295
CVE-2026-57295 describes a CSRF vulnerability in Jenkins EC2 Fleet Plugin (versions up to 4.2.3.539.v8fedff2a_81c3 and earlier). The issue lets an attacker cause Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained by another method, potentially captur...