Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Elasticsearch
MEDIUM 6.5
It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api…
Elasticsearch
MEDIUM 5.3
An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. …
Elasticsearch
MEDIUM 6.5
Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.…
Elasticsearch
HIGH 7.5
A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node …
Apm Server
HIGH 7.5
An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and t…
Kibana
MEDIUM 6.5
An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (F…
Network Drive Connector
MEDIUM 6.5
An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allo…
Kibana
MEDIUM 6.5
An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug …
Kibana
MEDIUM 6.5
An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana…
Elastic Beats
MEDIUM 6.5
An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that…
Elastic Agent
MEDIUM 6.5
An issue was discovered by Elastic whereby Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to …
Enterprise Search
MEDIUM 6.5
An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending …
Elasticsearch
HIGH 7.8
An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been mo…
Elasticsearch
HIGH 7.5
It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling t…
Elasticsearch
HIGH 8.8
An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is poss…
Apm Java Agent
HIGH 7.8
A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application ru…
Kibana
HIGH 8.8
Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with perm…
Kibana
HIGH 7.2
It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, th…
Logstash
MEDIUM 5.5
An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances. The prerequisites for th…
Elastic Cloud On Kubernetes
MEDIUM 5.3
Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being a…
Elasticsearch
HIGH 7.5
An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch…
Elasticsearch
HIGH 7.5
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimat…
Elastic Sharepoint Online Python Connector
MEDIUM 6.5
An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. …
Elastic Beats
HIGH 7.5
It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate i…
Kibana
HIGH 7.5
An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana v…
Fleet Server
HIGH 8.1
An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in …
Endpoint
CRITICAL 9.1
If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elas…
Kibana
HIGH 8.8
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could…
Kibana
HIGH 8.8
Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request…
Kibana
MEDIUM 6.1
An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted …