CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2016-1000220 – kibana: XSS vulnerability ESA-2016-03
https://notcve.org/view.php?id=CVE-2016-1000220
Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers. Las versiones de Kibana anteriores a 4.5.4 y 4.1.11 son vulnerables a un ataque XSS que permitiría a un atacante ejecutar JavaScript arbitrario en los navegadores de los usuarios. A cross-site scripting (XSS) flaw was found in Kibana. A remote attacker could use this flaw to inject arbitrary web script into pages served to other users. • http://www.securityfocus.com/bid/99179 https://www.elastic.co/community/security https://access.redhat.com/security/cve/CVE-2016-1000220 https://bugzilla.redhat.com/show_bug.cgi?id=1364389 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-8439
https://notcve.org/view.php?id=CVE-2017-8439
Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users. Kibana versión 5.4.0 estuvo afectada por un bug de Cross Site Scripting (XSS) en el Compilador Visual de Series Temporales. Este error podría permitir a un atacante obtener información confidencial de los usuarios de Kibana. • https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-released https://www.elastic.co/community/security • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2017-8440
https://notcve.org/view.php?id=CVE-2017-8440
Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. A partir de la versión 5.3.0, Kibana tenía una vulnerabilidad de cross-site scripting (XSS) en la página de Discover que podría permitir a un atacante obtener información confidencial o realizar acciones destructivas en nombre de otros usuarios de Kibana. • https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-released https://www.elastic.co/community/security • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2015-8131
https://notcve.org/view.php?id=CVE-2015-8131
Cross-site request forgery (CSRF) vulnerability in Elasticsearch Kibana before 4.1.3 and 4.2.x before 4.2.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Vulnerabilidad de CSRF en Elasticsearch Kibana en versiones anteriores a 4.1.3 y 4.2.x en versiones anteriores a 4.2.1 permite a atacantes remotos secuestrar la autenticación de víctimas no especificadas a través de vectores desconocidos. • http://www.securityfocus.com/archive/1/536935/100/0/threaded https://www.elastic.co/community/security • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2015-4093
https://notcve.org/view.php?id=CVE-2015-4093
Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Elasticsearch Kibana 4.x anterior a 4.0.3 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de vectores no especificados. • http://packetstormsecurity.com/files/132232/Kibana-4.0.2-Cross-Site-Scripting.html http://www.securityfocus.com/archive/1/535726/100/0/threaded http://www.securityfocus.com/bid/75107 https://www.elastic.co/community/security • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •