CVE-2024-21538 vulnerabilities

Vulnerabilities for packages: graalvm, argo-workflows, opensearch-dashboards, kibana, sqlpad, lerna, pgadmin4, airflow, py3-captum, opensearch-dashboards-fips, tileserver-gl, renovate, tileserver-gl-fips, node-gyp, ts-patch, arangodb, kubeflow-katib, eslint...

ROS-20241029-08

Vulnerability in the OpenSearch software package related to improper validation of the nextUrl parameter. Exploitation of the vulnerability could allow an attacker to redirect a user to a malicious site A vulnerability in the server.maxHeadersCount configuration of the ws client-server library in...

CVE-2024-47875 vulnerabilities

Vulnerabilities for packages: argo-workflows, opensearch-dashboards-fips...

GHSA-PXG6-PF52-XH8X vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows, opensearch-dashboards, kibana, sqlpad, thingsboard, kubeflow-centraldashboard, opensearch-dashboards-fips, jitsucom-jitsu, kubeflow-katib...

CVE-2024-47764 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows, opensearch-dashboards, kibana, sqlpad, thingsboard, kubeflow-centraldashboard, opensearch-dashboards-fips, jitsucom-jitsu, kubeflow-katib...

GHSA-78WR-2P64-HPWJ vulnerabilities

Vulnerabilities for packages: celeborn, sonarqube, zookeeper, kserve, strimzi-kafka-operator, hadoop-fips, confluent-common-docker, druid, apache-nifi, opensearch, management-api-for-apache-cassandra-4.0, sonarqube-10, confluent-kafka, hadoop-client-modules, management-api-for-apache-cassandra-5....

CVE-2024-47554 vulnerabilities

Vulnerabilities for packages: celeborn, sonarqube, zookeeper, kserve, strimzi-kafka-operator, hadoop-fips, confluent-common-docker, druid, apache-nifi, opensearch, management-api-for-apache-cassandra-4.0, sonarqube-10, confluent-kafka, hadoop-client-modules, management-api-for-apache-cassandra-5....

GHSA-735F-PC8J-V9W8 vulnerabilities

Vulnerabilities for packages: celeborn, hadoop-thirdparty, hadoop-fips, wavefront-proxy, trino, thingsboard, druid, apache-nifi, ruby3.4-fluentd-kubernetes-daemonset, debezium-connector-spanner, opensearch, sonarqube-10, confluent-kafka, hadoop-client-modules, confluent-kafka-jre-bcfips, tez,...

GHSA-MMHX-HMJR-R674 vulnerabilities

Vulnerabilities for packages: argo-workflows, opensearch-dashboards-fips, opensearch-dashboards...

CVE-2024-45801 vulnerabilities

Vulnerabilities for packages: argo-workflows, opensearch-dashboards-fips, opensearch-dashboards...

CVE-2024-45296 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows, opensearch-dashboards, thingsboard, sqlpad, kubeflow-centraldashboard, opensearch-dashboards-fips, arangodb...

CVE-2024-43794

OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Improper validation of the nextUrl parameter can lead to external redirect on login to OpenSearch-Dashboards for specially crafted parameters. A patch is availab...

CVE-2024-43794 OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect

OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Improper validation of the nextUrl parameter can lead to external redirect on login to OpenSearch-Dashboards for specially crafted parameters. A patch is availab...

CVE-2024-43794

CVE-2024-43794 affects the OpenSearch Dashboards Security Plugin, which adds a configuration management UI for OpenSearch Security features. The issue is improper validation of the nextUrl parameter, allowing external redirects on login for specially crafted inputs. A patch is available and recom...

CVE-2024-43794 OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect

OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Improper validation of the nextUrl parameter can lead to external redirect on login to OpenSearch-Dashboards for specially crafted parameters. A patch is availab...

CVE-2024-43794 OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect

OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Improper validation of the nextUrl parameter can lead to external redirect on login to OpenSearch-Dashboards for specially crafted parameters. A patch is availab...

PT-2024-7916 · Opensearch +2 · Opensearch Dashboards Security Plugin +2

Name of the Vulnerable Software and Affected Versions: OpenSearch Dashboards Security Plugin versions prior to 1.3.19 OpenSearch Dashboards Security Plugin versions prior to 2.16.0 Description: The issue is related to improper validation of the nextUrl parameter, which can lead to an external...

OpenSearch Dashboards Security Plugin 安全漏洞

OpenSearch Dashboards Security Plugin is an OpenSearch Dashboards Security Plugin for OpenSearch open source. A security vulnerability exists in OpenSearch Dashboards Security Plugin versions prior to 1.3.19 and prior to 2.16.0 that stems from improper validation of the nextUrl parameter, which m...

Privilege Escalation

org.opensearch.plugin:opensearch-reports-scheduler is vulnerable to Privilege Escalation. The vulnerability is due to improper checks on user authorization within the file UserAccessManager.kt when accessing resources in a private tenant, which allows an attacker to gain unauthorized access to...

The OpenSearch reporting plugin improperly controls tenancy access to reporting resources

Summary An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. Impact The lack of...