Elasticsearch CVE-2024-52979

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a

All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.

A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit

The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre

A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Le

The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files

An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration prope

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when th

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order