Elastic vulnerabilities
396 CVEs and advisories name Elastic as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-43707Kibana exposure of sensitive information to an unauthorized actor
- CVE-2024-43710Kibana server-side request forgery
- CVE-2024-52973Kibana allocation of resources without limits or throttling leads to crash
- CVE-2024-43709Elasticsearch allocation of resources without limits or throttling leads to crash
- CVE-2024-37284Elastic Defend Improper Handling of Alternate Encoding Leads to Crash
- CVE-2024-12539Elasticsearch Incorrect Authorization
- CVE-2024-37285Kibana arbitrary code execution via YAML deserialization
- CVE-2024-37288A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted pa
- CVE-2024-37287Kibana arbitrary code execution via prototype pollution
- CVE-2024-37283Elastic Agent Insertion of Sensitive Information into Log File
- CVE-2024-37286APM Server Insertion of Sensitive Information into Log File
- CVE-2024-23444Elasticsearch elasticsearch-certutil csr fails to encrypt private key
- CVE-2024-37281Kibana Denial of Service issue
- CVE-2023-49921An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level.
- CVE-2024-37282It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subs
- CVE-2024-23443A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted
- CVE-2024-23442Kibana open redirect issue
- CVE-2024-37279Kibana Broken Access Control issue
- CVE-2024-37280Elasticsearch StackOverflow vulnerability
- CVE-2024-23445Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions
- CVE-2024-23449Elasticsearch Uncaught Exception
- CVE-2024-23451Elasticsearch Incorrect Authorization in the Remote Cluster Security API key based security model
- CVE-2024-23450Elasticsearch Uncontrolled Resource Consumption vulnerability
- CVE-2024-23448APM Server Insertion of Sensitive Information into Log File
- CVE-2024-23447Elastic Network Drive Connector Improper Access Control
- CVE-2024-23446Kibana Broken Access Control issue
- CVE-2023-46675Kibana Insertion of Sensitive Information into Log File
- CVE-2023-46671Kibana Insertion of Sensitive Information into Log File
- CVE-2023-6687Elastic Agent Insertion of Sensitive Information into Log File
- CVE-2023-49922Beats Insertion of Sensitive Information into Log File