Show filters
185 Total Results
Displaying 181-185 of 185
Sort by:
Attacker Value
Unknown
CVE-2015-1427
Disclosure Date: February 17, 2015 (last updated July 17, 2024)
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
0
Attacker Value
Unknown
CVE-2014-6439
Disclosure Date: October 10, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
0
Attacker Value
Unknown
CVE-2014-3120
Disclosure Date: July 28, 2014 (last updated October 05, 2023)
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
0
Attacker Value
Unknown
CVE-2014-4326
Disclosure Date: July 22, 2014 (last updated October 05, 2023)
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.
0
Attacker Value
Unknown
CVE-2008-1606
Disclosure Date: April 01, 2008 (last updated October 04, 2023)
Multiple directory traversal vulnerabilities in Elastic Path (EP) 4.1 and 4.1.1 allow remote attackers to (1) download arbitrary files via a .. (dot dot) in the file parameter to manager/getImportFileRedirect.jsp, (2) upload arbitrary files via a "..\" (dot dot backslash) in the file parameter to importData.jsp, and (3) list directory contents via a .. (dot dot) in the dir parameter to manager/fileManager.jsp.
0
