CVE-2017-8443

In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be...

CVE-2017-8443

In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be...

CVE-2017-8443

CVE-2017-8443 affects Elastic Kibana X-Pack security prior to 5.4.3. A crafted Kibana URL can redirect to an improperly initialized login screen, causing credentials entered there to appear in the URL bar and potentially be viewed by others or logged. Remediation: upgrade to Kibana X-Pack 5.4.3 o...

CVE-2017-8443: Use of GET Request Method With Sensitive Query Strings

In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be...

PT-2017-18335

Name of the Vulnerable Software and Affected Versions Kibana X-Pack security versions prior to 5.4.3 Description The issue allows an attacker to craft a Kibana URL that could redirect a user to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the...

May 2017 Preview of the Quality Rollups for the .NET Framework 2.0 Service Pack 2, 4.5.2, and 4.6 for Windows Server 2008 Service Pack 2 (KB4019291): May 16, 2017

May 2017 Preview of the Quality Rollups for the .NET Framework 2.0 Service Pack 2, 4.5.2, and 4.6 for Windows Server 2008 Service Pack 2 KB4019291: May 16, 2017 Notice This release has been removed from Windows Update because of the issues that are described in the following .NET Blog article: .N...

libmtp ptp-pack.c file integer overflow vulnerability

libmtp is an LGPL library for the Media Transport Protocol. An integer overflow vulnerability exists in the ptp-pack.c file in libmtp 1.1.12 and earlier. A remote attacker could exploit this vulnerability by plugging a mobile device into a PC via the USB port to cause a denial of service...

Microsoft Office Code Execution

Vulnerabilities of the Microsoft Office suite of programs, the Microsoft OneNote note-taking software, the Microsoft Word text editor, the Office Web Apps Server web application, the Microsoft SharePoint Server web application, and the Microsoft Office Web Apps suite are related to improper acces...

IBM DB2 Connect 9.7 < FP11 Special Build 36621 / 10.1 < FP6 Special Build 36610 / 10.5 < FP8 Special Build 36605 / 11.1.2 < FP2 Multiple Vulnerabilities (Windows)

According to its version, the installation of IBM DB2 Connect on the remote Windows host is either 9.7 prior to Fix Pack 11 Special Build 36621, 10.1 prior to Fix Pack 6 Special Build 36610, 10.5 prior to Fix Pack 8 Special Build 36605, or 11.1.2 prior to Fix Pack 2. It is, therefore, affected by...

Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities

Exploit for linux platform in category web applications 1. Advisory Information Title: Kaspersky Anti-Virus File Server Multiple Vulnerabilities Advisory ID: CORE-2017-0003 Advisory URL: http://www.coresecurity.com/advisories/Kaspersky-Anti-Virus-File-Server-Multiple-Vulnerabilities Date publishe...

Flat Assembler 1.7.21 - Local Buffer Overflow

Flat Assembler 1.7.21 - Local Buffer Overflow !/usr/bin/python Developed using Exploit Pack - http://exploitpack.com - Exploit Author: Juan Sacco at KPN Red Team - http://www.kpn.com Tested on: GNU/Linux - Kali 2017.1 Release What is FASM? Flat assembler is a fast, self-compilable assembly langua...

Elastic Stack 5.4.3 Security update

Kibana X-Pack Security user credentials disclosure ESA-2017-11 In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the...

JAD Java Decompiler 1.5.8e - Local Buffer Overflow (NX Enabled)

JAD Java Decompiler 1.5.8e - Local Buffer Overflow NX Enabled !/usr/bin/python Exploit Author: Juan Sacco at KPN Red Team - http://www.kpn.com Developed using Exploit Pack - http://exploitpack.com - Tested on: GNU/Linux - Kali 2017.1 Release Description: JAD Java Decompiler 1.5.8e-1kali1 and prio...

Command injection

If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility ASU, UpdateXpress System Pack Installer UXSPI or Dynamic System Analysis DSA to a second machine, the other users may be able to see the user ID...

CVE-2017-3743

If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility ASU, UpdateXpress System Pack Installer UXSPI or Dynamic System Analysis DSA to a second machine, the other users may be able to see the user ID...

CVE-2017-3743: Exposure of Sensitive Information to an Unauthorized Actor

If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility ASU, UpdateXpress System Pack Installer UXSPI or Dynamic System Analysis DSA to a second machine, the other users may be able to see the user ID...

PT-2017-16077

Name of the Vulnerable Software and Affected Versions Lenovo ToolsCenter Advanced Settings Utility ASU affected versions not specified Lenovo UpdateXpress System Pack Installer UXSPI affected versions not specified Lenovo Dynamic System Analysis DSA affected versions not specified Description The...

Open Redirect Attack

Kibana is vulnerable to open redirect attacks. When X-Pack is installed, attackers are able to craft a link through the login page that redirects to an arbitrary website...

Privilege Bypass

Kibana is vulnerable to privilege bypass attacks. When X-Pack is installed, requests to the short URL and advanced settings services. This flaw allows authenticated users to make requests to those services regardless of their own permissions...

ElasticSearch X-Pack security information disclosure vulnerability (CNVD-2017-15509)

ElasticSearch X-Pack is an extension of the Elastic Stack log analysis system from the Dutch company Elasticsearch. security is one of the features used to control access rights. ElasticSearch X-Pack security has an information disclosure vulnerability. Allow attackers to exploit the vulnerabilit...