Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Kibana
MEDIUM 5.4
Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.
Kibana
MEDIUM 6.5
Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access a…
Kibana
MEDIUM 5.4
URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via …
Kibana
HIGH 8.8
Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.
Kibana
CRITICAL 9.8
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.
Elastic Agent
HIGH 7.8
Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitrary code v…
Elasticsearch
HIGH 7.5
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial …
Kibana
MEDIUM 5.4
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML a…
Elastic Agent
HIGH 7.1
Exposure of sensitive information to local unauthorized actors in Elastic Agent and Elastic Security Endpoint can lead to loss of confidentiality and…
Kibana
CRITICAL 9.8
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.
Elasticsearch
HIGH 7.5
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects co…
Kibana
MEDIUM 6.5
An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful att…
Elasticsearch
MEDIUM 6.5
A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause…
Kibana
CRITICAL 9.9
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions …
Kibana
MEDIUM 6.5
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in …
Kibana
MEDIUM 6.5
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot.…
Kibana
MEDIUM 6.5
An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The …
Kibana
MEDIUM 6.5
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summa…
Elasticsearch
HIGH 7.5
An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a special…
Elasticsearch
MEDIUM 6.5
An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Leve…
Kibana
HIGH 7.2
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A …
Kibana
HIGH 8.8
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. Th…
Kibana
HIGH 7.2
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write ac…
Elastic Agent
MEDIUM 6.5
An issue was discovered whereby Elastic Agent will leak secrets from the agent policy elastic-agent.yml only when the log level is configured to debu…
Apm Server
MEDIUM 6.5
APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailable_shards_exception for a specific…
Elasticsearch
HIGH 7.5
It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate S…
Kibana
MEDIUM 6.5
An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously craft…
Elasticsearch
MEDIUM 6.5
An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents o…
Elastic Cloud Enterprise
CRITICAL 9.8
It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently …
Kibana
MEDIUM 6.1
An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted …