The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell…

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source…

Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol

Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process

An issue was found with how API keys are created with the Fleet-Server service account

The fix for CVE-2020-7009 was found to be incomplete

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API

A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or…

An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users

Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the…

An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow

An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL…

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the…

A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash

It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API

A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service

An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer

A Denial of Service flaw was discovered in Elasticsearch

All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters

The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker,…

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates

Incorrect Authorization in Elasticsearch Leading to Privilege Escalation

Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure

Missing Authorization in Elasticsearch Leading to Information Disclosure

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service

Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service