CVE-2017-8450

X-Pack 5.1.1 did not properly apply document and field level security to multi-search and multi-get requests so users without access to a document and/or field may have been able to access this information...

CVE-2017-8449

X-Pack Security 5.2.x would allow access to more fields than the user should have seen if the field level security rules used a mix of grant and exclude rules when merging multiple rules with field level security rules for the same index...

Code injection

With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authenticated user could make requests to those services regardless of their own permissions...

Information disclosure

X-Pack 5.1.1 did not properly apply document and field level security to multi-search and multi-get requests so users without access to a document and/or field may have been able to access this information...

Open redirect

With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website...

CVE-2017-8449

X-Pack Security 5.2.x would allow access to more fields than the user should have seen if the field level security rules used a mix of grant and exclude rules when merging multiple rules with field level security rules for the same index...

Design/Logic Flaw

X-Pack Security 5.2.x would allow access to more fields than the user should have seen if the field level security rules used a mix of grant and exclude rules when merging multiple rules with field level security rules for the same index...

CVE-2017-8451

With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website...

CVE-2017-8451

With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website...

CVE-2016-10364

With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authenticated user could make requests to those services regardless of their own permissions...

CVE-2017-8450

X-Pack 5.1.1 did not properly apply document and field level security to multi-search and multi-get requests so users without access to a document and/or field may have been able to access this information...

CVE-2016-10364

With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authenticated user could make requests to those services regardless of their own permissions...

CVE-2017-8450

X-Pack 5.1.1 did not properly apply document and field level security to multi-search and multi-get requests so users without access to a document and/or field may have been able to access this information...

CVE-2017-8449

X-Pack Security 5.2.x would allow access to more fields than the user should have seen if the field level security rules used a mix of grant and exclude rules when merging multiple rules with field level security rules for the same index...

CVE-2017-8450

CVE-2017-8450 concerns Elastic Stack: Elastic Kibana X-Pack 5.1.1. The issue is an information-disclosure vulnerability where document and field level security were not properly enforced for multi-search and multi-get requests, potentially allowing users without access to certain documents/fields...

CVE-2017-8451

Kibana with X-Pack is affected by CVE-2017-8451, exposing an open redirect on the login page in versions before 5.3.1. The vulnerability details and exact remediation are not fully described in the provided documents; upgrade information beyond “before 5.3.1” is not specified here.

CVE-2017-8449

CVE-2017-8449 affects Elastic X-Pack Security 5.2.x (Elasticsearch/Kibana). When field-level security rules for the same index are merged with a mix of grant and exclude rules, a user could see more fields than permitted. This has been documented by SUSE and OpenVAS plugins, with CVSS base scores...

CVE-2016-10364

With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authenticated user could make requests to those services regardless of their own permissions...

CVE-2016-10364

CVE-2016-10364 affects Elastic Kibana with X-Pack. The vulnerability is described as an improper authentication/insufficient access restriction in Kibana 5.0.0 and 5.0.1, where any authenticated user could issue requests to the advanced settings and short URL services regardless of permissions. T...

Microsoft Project Server 2013 XSS Vulnerability (KB3203399)

This host is missing an important security update according to Microsoft KB3203399 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...