Kibana Arbitrary Code Execution

Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints

Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin

Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports

Improper Control of Generation of Code in Fleet Server Leading to Code Injection

Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception

Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure

Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload

Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports

Kibana version 8.7.0 contains an arbitrary code execution flaw

Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw

Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant

External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector

Incorrect Authorization in Kibana Leading to Privilege Escalation

Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification

Incorrect Authorization in Kibana Leading to Privilege Escalation

Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions

Improper Output Neutralization for Logs in Kibana Leading to Log Injection

Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data

Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access

Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access

Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure

Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope

Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)

Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service

Improper Input Validation in Kibana Leading to Denial of Service

Improper Input Validation in Metricbeat Leading to Denial of Service

An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error

Kibana versions prior to 5.2.1 configured for SSL client access, file descriptors will fail to be cleaned up after certain requests and will accumulate over time until the process…

Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files

Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources

Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload

A flaw allowing arbitrary code execution was discovered in Kibana

It was discovered that a user with Fleet admin permissions could upload a malicious package

Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB

Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys

Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models

Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents