Elastic vulnerabilities
396 CVEs and advisories name Elastic as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2020-7017In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw.
- CVE-2020-7016Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion.
- CVE-2020-7015Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization.
- CVE-2020-7014The fix for CVE-2020-7009 was found to be incomplete.
- CVE-2020-7013Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB.
- CVE-2020-7012Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant.
- CVE-2020-7011Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI.
- CVE-2020-7010Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator.
- CVE-2020-7009Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create A
- CVE-2019-7621Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations.
- CVE-2019-7620Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin.
- CVE-2019-7619Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service.
- CVE-2019-7618A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2.
- CVE-2019-7617When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker
- CVE-2019-7616Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer
- CVE-2019-7615A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0.
- CVE-2019-7614A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request.
- CVE-2019-7613Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw.
- CVE-2019-7612A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs.
- CVE-2019-7611A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are dis
- CVE-2019-7610Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger.
- CVE-2019-7608Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive info
- CVE-2019-7609Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer.
- CVE-2018-17247Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API.
- CVE-2018-17246Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin.
- CVE-2018-17245Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating P
- CVE-2018-17244Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Dir
- CVE-2018-3831Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured vi
- CVE-2018-3830Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to
- CVE-2018-3829In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on new hosts with an inva