elastic elastic cloud enterprise vulnerabilities and exploits

(subscribe to this query)

An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elasti...

Elastic Elasticsearch Elastic Elastic Cloud Enterprise Elastic Elastic Cloud Enterprise 3.6.0

A flaw exists in ECE prior to 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster.

Elastic Elastic Cloud Enterprise

A flaw exists in ECE prior to 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings values in logs such as the audit log or deployment logs in the Logging and Monitoring cluster. The affected APIs are PATCH /ap...

Elastic Elastic Cloud Enterprise

In Elastic Cloud Enterprise (ECE) versions before 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritten, this master key is predictable across all ECE deployments. If an attacker can conn...

Elastic Elastic Cloud Enterprise

Elastic Cloud Enterprise (ECE) versions before 1.1.4 contain an information exposure vulnerability. It exists that certain exception conditions would result in encryption keys, passwords, and other security sensitive headers being leaked to the allocator logs. An attacker with ac...

Elastic Elastic Cloud Enterprise

In Elastic Cloud Enterprise (ECE) versions before 1.1.4 it exists that a user could scale out allocators on new hosts with an invalid roles token. An attacker with access to the previous runner ID and IP address of the coordinator-host could add a allocator to an existing ECE ins...

Elastic Elastic Cloud Enterprise

All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could le...

Elastic Elasticsearch 7.13.3

1 Github repository

The client-forwarder in Elastic Cloud Enterprise versions before 1.0.2 do not properly encrypt traffic to ZooKeeper. If an attacker is able to man in the middle (MITM) the traffic between the client-forwarder and ZooKeeper they could potentially obtain sensitive data.

Elasticsearch Cloud Enterprise 1.0.1 Elasticsearch Cloud Enterprise 1.0.0

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnera...

Apache Kafka Apache Kafka 2.8.0 Quarkus Quarkus Oracle Primavera Unifier 18.8 Oracle Primavera Unifier 19.12 Oracle Primavera Unifier 20.12 Oracle Primavera Unifier 21.12 Oracle Financial Services Enterprise Case Management 8.0.8.1 Oracle Financial Services Enterprise Case Management 8.1.1.0 Oracle Financial Services Enterprise Case Management 8.1.1.1 Oracle Financial Services Behavior Detection Platform 8.1.2.0 Oracle Financial Services Behavior Detection Platform 8.1.1.1 Oracle Financial Services Behavior Detection Platform 8.1.1.0 Oracle Financial Services Enterprise Case Management 8.0.7.1 Oracle Financial Services Enterprise Case Management 8.0.8.0 Oracle Financial Services Behavior Detection Platform Oracle Communications Cloud Native Core Policy 1.15.0 Oracle Financial Services Enterprise Case Management 8.0.7.2 Oracle Financial Services Analytical Applications Infrastructure Oracle Communications Brm - Elastic Charging Engine 12.0.0.5.0 Oracle Communications Brm - Elastic Charging Engine

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook