Kibana Cross-site Scripting via the Integration Package Upload Functionality

Kibana Stored Cross-Site Scripting (XSS)

Kibana Cross-Site Scripting (XSS)

Kibana Insufficiently Protected Credentials in the CrowdStrike Connector

Kibana Open Redirect

Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS

It was discovered that Kibana was not sanitizing document fields containing HTML snippets

An XSS vulnerability was found in Kibana index patterns

Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization

Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations

Incorrect Authorization in Kibana Leading to Information Disclosure

Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access

A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source

Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack

Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer

Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure

Missing Authorization in Kibana Leading to Information Disclosure

Incorrect Authorization in Kibana Leading to Denial of Service

Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations

Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure

Improper Control of Generation of Code in Kibana Leading to Privilege Escalation

Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption

Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation

Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata

Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments

Missing Authorization in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise

Missing Authorization in Kibana Leading to Unauthorized Information Disclosure

Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure

Incorrect Authorization in Kibana Fleet Leading to Information Disclosure

Kibana Improper Authorization

Kibana Improper Authorization

Kibana Origin Validation Error

Kibana Unrestricted Upload of File

Kibana server-side request forgery

A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system…

It was discovered that Kibana was not validating a user supplied path, which would load .pbf files

A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules

It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files

It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate requests

Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana

Uncaught Exception in Kibana Cases Leading to Denial of Service

In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being respected