CVE-2025-24016-Wazuh-Remote-Code-Execution-RCE-PoC

🚨 Wazuh リモートコード実行 RCE - PoC 📌 脆弱性概要 Wazuh サーバーにおいて、wazuh-manager パッケージの安全でないデシリアライゼーションにより、深刻な RCE 脆弱性が確認されました。このバグは Wazuh バージョン 4.4.0 以上に影響し、バージョン 4.9.1 で修正されています。 🔍 詳細 この欠陥は Wazuh API の DistributedAPI にあり、ユーザー制御の入力が安全でない方法でデシリアライズされます。これにより、API アクセスを持つ攻撃者（例: 侵害されたダッシュボードやクラスターノード）が、runas...

CVE-2026-74039 Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allowrunas enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/runas endpoint. Attackers can...

CVE-2026-74039

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 are vulnerable to CPU-exhaustion DoS. Authenticated attackers with allow_run_as enabled can submit arbitrarily deeply nested auth_context JSON to POST /security/user/authenticate/run_as, causing the API framework to consume excessive CPU and deny service ...

EUVD-2017-17389

Malware in sbrugna...

ElasticSearch X-Pack Security Elevation of Privilege Vulnerability

ElasticSearch X-Pack is an extension of the Elastic Stack log analysis system from the Dutch company Elasticsearch. security is one of the features used to control access rights. An elevation of privilege vulnerability exists in the runas feature in ElasticSearch X-Pack Security versions 5.0.0...

Design/Logic Flaw

Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the runas functionality. This bug prevents transitioning into the specified user specified in a runas request. If a role has been created using a template that contains the user properties, the behavior of runas...

CVE-2017-8438

Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the runas functionality. This bug prevents transitioning into the specified user specified in a runas request. If a role has been created using a template that contains the user properties, the behavior of runas...

CVE-2017-8438

Elastic X-Pack Security (Elasticsearch X-Pack Security) versions 5.0.0–5.4.0 contain a privilege escalation vulnerability in the run_as functionality. The bug prevents transitioning to the specified user in a run_as request, and can misbehave if a role template includes the _user properties or if...