Kibana Arbitrary Code Execution

Kibana arbitrary code execution via prototype pollution

Kibana arbitrary code execution via prototype pollution

Kibana Prototype Pollution can lead to code injection

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin

Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports

Improper Control of Generation of Code in Fleet Server Leading to Code Injection

Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception

Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure

Kibana Improper Authorization

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload

Kibana Reporting vulnerabilities

Kibana version 8.7.0 contains an arbitrary code execution flaw

Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw

Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant

External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector

Incorrect Authorization in Kibana Leading to Privilege Escalation

Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification

Incorrect Authorization in Kibana Leading to Privilege Escalation

Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions

Improper Output Neutralization for Logs in Kibana Leading to Log Injection

Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data

Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access

Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access

Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure

Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope

Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)

Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service

Improper Input Validation in Kibana Leading to Denial of Service

Improper Input Validation in Metricbeat Leading to Denial of Service

Kibana Insertion of Sensitive Information into Log File

Kibana versions prior to 5.2.1 configured for SSL client access, file descriptors will fail to be cleaned up after certain requests and will accumulate over time until the process…

Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files

Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources

Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts

Kibana arbitrary code execution via YAML deserialization

Kibana arbitrary code execution via prototype pollution

Kibana code execution issue

Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB

Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys

Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models

Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents