Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2015-4165

elasticsearch: unspecified arbitrary files modification vulnerability

The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and execute from, allows remote authenticated users to write to and create arbitrary snapshot metadata files, and potentially execute arbitrary code.

CVSS 3.0 · 7.5 High EPSS 4.5% KEV · Not listed
Vendors
Elasticsearch
Products
Elasticsearch
CVE-2014-6439

Elasticsearch: CSRF via insecure CORS default configuration

Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Elasticsearch
Products
Elasticsearch
CVE-2015-3337

elasticsearch: directory traversal flaw

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 33.2% KEV · Not listed
Vendors
Elasticsearch
Products
Elasticsearch
CVE-2015-5531

elasticsearch: directory traversal attack

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.

CVSS 2.0 · 5.0 Medium EPSS 94.8% KEV · Not listed
Vendors
Elasticsearch
Products
Elasticsearch