Elastic vulnerabilities
396 CVEs and advisories name Elastic as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-49923Enterprise Search Insertion of Sensitive Information into Log File
- CVE-2023-46674Elasticsearch-hadoop Unsafe Deserialization
- CVE-2023-46673It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when
- CVE-2021-37937Elasticsearch privilege escalation
- CVE-2021-37942APM Java Agent Local Privilege Escalation
- CVE-2021-22143Elastic APM .NET Agent information disclosure
- CVE-2021-22142Kibana Reporting vulnerabilities
- CVE-2021-22151Kibana path traversal issue
- CVE-2021-22150Kibana code execution issue
- CVE-2023-46672Logstash Insertion of Sensitive Information into Log File
- CVE-2023-31416Elastic Cloud on Kubernetes (ECK) secret token configuration issue
- CVE-2023-31417Elasticsearch Insertion of sensitive information in audit logs
- CVE-2023-31418Elasticsearch uncontrolled resource consumption
- CVE-2023-31419Elasticsearch StackOverflow vulnerability
- CVE-2023-46666Elastic Sharepoint Online Python Connector Improper Access Control
- CVE-2023-31421Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue
- CVE-2023-31422Kibana Insertion of Sensitive Information into Log File
- CVE-2023-46667Fleet Server Insertion of Sensitive Information into Log File
- CVE-2023-46668Elastic Endpoint Insertion of Sensitive Information into Log File
- CVE-2023-31415Kibana version 8.7.0 contains an arbitrary code execution flaw.
- CVE-2023-31414Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw.
- CVE-2023-31413Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization h
- CVE-2022-38779An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously
- CVE-2022-38778A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a requ
- CVE-2022-38777An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate th
- CVE-2022-38775An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate th
- CVE-2022-38774An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which could allow unprivileg
- CVE-2021-37936It was discovered that Kibana was not sanitizing document fields containing HTML snippets.
- CVE-2021-22141An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16.
- CVE-2022-23716A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in d