Elasticsearch X-Pack Security Information Disclosure Vulnerability (CNVD-2017-14900)

Elasticsearch X-Pack is an extension of Elastic Stack log analysis system from the Dutch company Elasticsearch.Security is one of the features used to control access rights. A security vulnerability exists in Elasticsearch X-Pack Security versions 5.0.0 through 5.4.3. An attacker can exploit this...

CVE-2017-8442

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated...

CVE-2017-8442

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated...

Authentication flaw

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated...

CVE-2017-8442

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated...

CVE-2017-8442

CVE-2017-8442 affects Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3. When enabled, the Elasticsearch _nodes API can leak sensitive configuration information, including paths and passphrases of SSL keys used by an authentication realm, potentially exposing credentials to an authenticated u...

CVE-2017-8442: Transmission of Private Resources into a New Sphere

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated...

PT-2017-18334

Name of the Vulnerable Software and Affected Versions Elasticsearch X-Pack Security versions 5.0.0 through 5.4.3 Description The issue allows an authenticated Elasticsearch user to improperly view sensitive configuration information, including the paths and passphrases of SSL keys configured as...

Elastic Stack 5.5 Security update

Elasticsearch X-Pack Security user credentials disclosure ESA-2017-10 Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as...

Elasticsearch Kibana X-Pack Security Information Disclosure Vulnerability

Elasticsearch Kibana X-Pack security formerly known as elasticsearch-dashboard is a security version of a set of open source, browser-based analytics and search tools for Elasticsearch dashboards from the Dutch company Elasticsearch. A security vulnerability exists in Elasticsearch Kibana X-Pack...

CVE-2017-8443

In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be...

Design/Logic Flaw

In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be...

CVE-2017-8443

In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be...

CVE-2017-8443

In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be...

CVE-2017-8443

CVE-2017-8443 affects Elastic Kibana X-Pack security prior to 5.4.3. A crafted Kibana URL can redirect to an improperly initialized login screen, causing credentials entered there to appear in the URL bar and potentially be viewed by others or logged. Remediation: upgrade to Kibana X-Pack 5.4.3 o...

CVE-2017-8443: Use of GET Request Method With Sensitive Query Strings

In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be...

PT-2017-18335

Name of the Vulnerable Software and Affected Versions Kibana X-Pack security versions prior to 5.4.3 Description The issue allows an attacker to craft a Kibana URL that could redirect a user to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the...

May 2017 Preview of the Quality Rollups for the .NET Framework 2.0 Service Pack 2, 4.5.2, and 4.6 for Windows Server 2008 Service Pack 2 (KB4019291): May 16, 2017

May 2017 Preview of the Quality Rollups for the .NET Framework 2.0 Service Pack 2, 4.5.2, and 4.6 for Windows Server 2008 Service Pack 2 KB4019291: May 16, 2017 Notice This release has been removed from Windows Update because of the issues that are described in the following .NET Blog article: .N...

Microsoft Office Code Execution

Vulnerabilities of the Microsoft Office suite of programs, the Microsoft OneNote note-taking software, the Microsoft Word text editor, the Office Web Apps Server web application, the Microsoft SharePoint Server web application, and the Microsoft Office Web Apps suite are related to improper acces...

libmtp ptp-pack.c file integer overflow vulnerability

libmtp is an LGPL library for the Media Transport Protocol. An integer overflow vulnerability exists in the ptp-pack.c file in libmtp 1.1.12 and earlier. A remote attacker could exploit this vulnerability by plugging a mobile device into a PC via the USB port to cause a denial of service...