CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-38774
https://notcve.org/view.php?id=CVE-2022-38774
An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account. Se descubrió un problema en la función de cuarentena de Elastic Endpoint Security y Elastic Endgame para Windows, que podría permitir a los usuarios sin privilegios elevar sus permisos a los de la cuenta LocalSystem. • https://discuss.elastic.co/t/endpoint-security-8-4-0-7-17-7-and-endgame-3-62-3-security-statement/323754 https://www.elastic.co/community/security • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-38775
https://notcve.org/view.php?id=CVE-2022-38775
An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account. Se descubrió un problema en la función de reversión de Elastic Endpoint Security para Windows, que podría permitir a los usuarios sin privilegios elevar sus privilegios a los de la cuenta LocalSystem. • https://discuss.elastic.co/t/endpoint-security-8-4-1-security-statement/323753 https://www.elastic.co/community/security • CWE-269: Improper Privilege Management •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-22141
https://notcve.org/view.php?id=CVE-2021-22141
An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website. Se encontró una falla de redireccionamiento abierto en las versiones de Kibana anteriores a la versiones 7.13.0 y 6.8.16. Si un usuario que ha iniciado sesión visita una URL creada con fines malintencionados, Kibana podría redirigir al usuario a un sitio web arbitrario. • https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964 https://www.elastic.co/community/security • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-37936
https://notcve.org/view.php?id=CVE-2021-37936
It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user. Se descubrió que Kibana no estaba sanitizando los campos de documentos que contenían fragmentos de HTML. Utilizando esta vulnerabilidad, un atacante con la capacidad de escribir documentos en un índice de elasticsearch podría inyectar HTML. • https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077 https://www.elastic.co/community/security • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23716
https://notcve.org/view.php?id=CVE-2022-23716
A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster. Se ha detectado un fallo en ECE versiones anteriores a 3.1.1, que podía conllevar a una revelación de la clave privada de firma de SAML usada para las funciones RBAC, en los registros de despliegue del clúster de registro y supervisión • https://discuss.elastic.co/t/elastic-cloud-enterprise-3-1-1-security-update/315317 https://www.elastic.co/community/security • CWE-532: Insertion of Sensitive Information into Log File •