CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2015-8131
https://notcve.org/view.php?id=CVE-2015-8131
Cross-site request forgery (CSRF) vulnerability in Elasticsearch Kibana before 4.1.3 and 4.2.x before 4.2.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Vulnerabilidad de CSRF en Elasticsearch Kibana en versiones anteriores a 4.1.3 y 4.2.x en versiones anteriores a 4.2.1 permite a atacantes remotos secuestrar la autenticación de víctimas no especificadas a través de vectores desconocidos. • http://www.securityfocus.com/archive/1/536935/100/0/threaded https://www.elastic.co/community/security • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2015-4093
https://notcve.org/view.php?id=CVE-2015-4093
Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Elasticsearch Kibana 4.x anterior a 4.0.3 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de vectores no especificados. • http://packetstormsecurity.com/files/132232/Kibana-4.0.2-Cross-Site-Scripting.html http://www.securityfocus.com/archive/1/535726/100/0/threaded http://www.securityfocus.com/bid/75107 https://www.elastic.co/community/security • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •