Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
elasticsearch elasticsearch 1.4.0 vulnerabilities and exploits
(subscribe to this query)
795
VMScore
CVE-2015-1427
The Groovy scripting engine in Elasticsearch prior to 1.3.8 and 1.4.x prior to 1.4.3 allows remote malicious users to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Elasticsearch Elasticsearch
Elasticsearch Elasticsearch 1.4.0
Elasticsearch Elasticsearch 1.4.1
Elasticsearch Elasticsearch 1.4.2
2 EDB exploits
2 Nmap scripts
17 Github repositories
2 Articles
668
VMScore
CVE-2014-4326
Elasticsearch Logstash 1.0.14 up to and including 1.4.x prior to 1.4.2 allows remote malicious users to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.
Elastic Logstash 1.0.14
Elastic Logstash 1.0.15
Elastic Logstash 1.0.16
Elastic Logstash 1.0.17
Elastic Logstash 1.1.0.1
Elastic Logstash 1.1.2
Elastic Logstash 1.1.3
Elastic Logstash 1.1.4
Elastic Logstash 1.1.5
Elastic Logstash 1.1.6
Elastic Logstash 1.1.7
Elastic Logstash 1.1.8
Elastic Logstash 1.1.9
Elastic Logstash 1.1.10
Elastic Logstash 1.1.11
Elastic Logstash 1.1.12
Elastic Logstash 1.1.13
Elastic Logstash 1.2.1
Elastic Logstash 1.2.2
Elastic Logstash 1.3.0
Elastic Logstash 1.3.1
Elastic Logstash 1.3.2
445
VMScore
CVE-2015-5378
Logstash 1.5.x prior to 1.5.3 and 1.4.x prior to 1.4.4 allows remote malicious users to read communications between Logstash Forwarder agent and Logstash server.
Elasticsearch Logstash 1.5.1
Elasticsearch Logstash 1.4.3
Elasticsearch Logstash 1.5.0
Elasticsearch Logstash 1.5.2
Elastic Logstash 1.4.1
Elastic Logstash 1.4.2
Elastic Logstash 1.4.0
383
VMScore
CVE-2015-5619
Logstash 1.4.x prior to 1.4.5 and 1.5.x prior to 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash server, which might allow malicious users to obtain sensitive information via a man-in-the-middle attack.
Elasticsearch Logstash 1.5.3
Elasticsearch Logstash 1.4.4
Elasticsearch Logstash 1.5.1
Elasticsearch Logstash 1.4.3
Elasticsearch Logstash 1.5.0
Elasticsearch Logstash 1.5.2
Elastic Logstash 1.4.1
Elastic Logstash 1.4.2
Elastic Logstash 1.4.0
383
VMScore
CVE-2014-6439
Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch prior to 1.4.0.Beta1 allows remote malicious users to inject arbitrary web script or HTML via unspecified vectors.
Elasticsearch Elasticsearch
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-3080
log injection
CVE-2024-6041
CVE-2024-37661
XML external entity
CVE-2024-0845
privilege escalation
CVE-2023-37057
CVE-2024-27801
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started