CVE Vulnerability Catalog

A resource allocation vulnerability (CWE-770) in Kibana can lead to denial of service. An authenticated user with low, read-level Agent Builder privileges could submit a crafted request causing unbounded memory consumption and process termination.

A vulnerability in Kibana's machine learning feature involving execution with unnecessary privileges (CWE-250) can lead to information disclosure. An operation available to read-only users was performed with an internal service identity, allowing access to Elasticsearch indices the user is not authorized to read.

A vulnerability in Kibana allows an authenticated user to submit a specially crafted request that causes excessive resource consumption, potentially leading to a denial of service and making Kibana unavailable.

Deserialization of untrusted data in Elasticsearch machine learning component can lead to remote code execution via object injection. A crafted trained model artifact could execute attacker-controlled logic with broader system-call surface. Requires authenticated user with privileges to create and deploy models.

A vulnerability in Kibana allows a user with low privileges (access to Observability AI Assistant) to submit a specially crafted request that causes an unhandled error, terminating the Kibana process and denying service to all users until restart.

A vulnerability in Kibana allows an authenticated user with read-only access to Security Solution in a Kibana space to enumerate and change the state of Entity Store maintainer tasks, potentially disabling Entity Analytics maintenance for that space.

A vulnerability in Kibana Entity Analytics allows a user with read-only Security access and no Elasticsearch privileges to stop the recurring Privilege Monitoring engine task for a Kibana space, causing monitoring data to stop being produced while the engine still reports a healthy state.

A vulnerability in Kibana related to handling highly compressed data allows an authenticated user with Streams management privileges to supply specially crafted content that expands to a much larger volume during processing, exhausting Kibana's memory and causing the process to be terminated by the host.

A vulnerability in Kibana allows an authenticated user with access to the query functionality to perform NoSQL injection, altering the intended query logic and returning data the user is not authorized to read.

Incorrect authorization in Kibana can lead to privilege escalation. A user with workflow edit permissions could cause scheduled workflow executions to run with higher-privileged user's privileges, allowing unauthorized data access and modification.

A vulnerability in Elasticsearch allows a user with elevated privileges to submit a specially crafted request that causes excessive memory consumption, potentially making the affected node unavailable.

Konga before 2.1.0 has a privilege escalation vulnerability allowing low-privileged local attackers to execute arbitrary code by planting OpenSSL config or library files in a hardcoded filesystem path absent from default installations. On Windows, the missing directory is writable by any authenticated user, enabling attackers to create it and place malicious files that execute with the privileges of the launching account.

A vulnerability in Kibana allows an authenticated user with low-level permissions to submit a specially crafted request that causes excessive resource consumption, potentially making Kibana unavailable.

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete compromise of the AFC host.

Wyoming before 1.10.2 has a server-side request forgery vulnerability allowing unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious `uri` query parameter to the HTTP API. Attackers can pass arbitrary `tcp://` or `unix://` URIs to endpoints including /api/info, /api/speech-to-text, and /api/text-to-speech to override the server-configured backend.

A vulnerability in Filament (a collection of components for Laravel) in versions from 4.0.0 to 4.12.6 and 5.7.6 allows reuse of a previously issued app-based MFA code even after a newer code has been used, for approximately four minutes, enabling an attacker with the password and one MFA code to access the account.

A vulnerability in sqlparse (a SQL parser module for Python) before version 0.6.0 causes excessive CPU consumption when formatting queries with parenthesized tuple lists, potentially leading to request delays and reduced throughput.

gRPC-Go prior to 1.83.1 stores each fragmented HTTP/2 DATA frame as a separate recvMsg, so millions of one-byte frames can consume disproportionate heap memory. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or OOM termination. Receive-buffer compaction is enabled by default and can be controlled with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. Fixed in 1.83.1.

gRPC-Go prior to version 1.83.1 contains a vulnerability in the xDS RBAC HTTP filter where header matcher names are not lowercased even though incoming metadata keys are lowercase. A DENY policy using mixed-case names such as X-Role or User-Agent does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from DescribePipeline API responses and forge valid integrity signatures for crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.