CVSS: 8.0EPSS: 0%CPEs: 2EXPL: 0CVE-2018-3830 – kibana: Cross-site scripting via the source field formatter
https://notcve.org/view.php?id=CVE-2018-3830
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Las versiones 5.3.0 a 6.4.1 de Kibana presentaban una vulnerabilidad Cross-Site Scripting (XSS) a través del formateador de los campos de origen que podrían permitir a un atacante obtener información sensible o realizar acciones destructivas en nombre de otros usuarios de Kibana. • https://access.redhat.com/errata/RHSA-2018:3537 https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035 https://www.elastic.co/community/security https://access.redhat.com/security/cve/CVE-2018-3830 https://bugzilla.redhat.com/show_bug.cgi?id=1632450 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-3818
https://notcve.org/view.php?id=CVE-2018-3818
Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Las versiones 5.1.1 a 6.1.2 y 5.6.6 de Kibana presentan una vulnerabilidad Cross-Site Scripting (XSS) a través del formateador de los campos de color que podrían permitir a un atacante obtener información sensible o realizar acciones destructivas en nombre de otros usuarios de Kibana. • http://www.securityfocus.com/bid/102734 https://discuss.elastic.co/t/elastic-stack-6-1-2-and-5-6-6-security-update/115763 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-3821
https://notcve.org/view.php?id=CVE-2018-3821
Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud visualization that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Las versiones posteriores a la 5.1.1 y anteriores a la 5.6.7 y 6.1.3 de Kibana presentan una vulnerabilidad Cross-Site Scripting (XSS) en la visualización de la nube de etiquetas que podrían permitir a un atacante obtener información sensible o realizar acciones destructivas en nombre de otros usuarios de Kibana. • https://discuss.elastic.co/t/elastic-stack-6-1-3-and-5-6-7-security-update/117683 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-3819
https://notcve.org/view.php?id=CVE-2018-3819
The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website. La solución en Kibana para ESA-2017-23 era incompleta. Con la seguridad X-Pack habilitada, las versiones anteriores a la 6.1.2 y 5.6.7 de Kibana tienen una vulnerabilidad de redirección abierta en la página de inicio de sesión que permitiría que un atacante cree un enlace que redirija a una página web arbitraria. • https://discuss.elastic.co/t/elastic-stack-6-1-3-and-5-6-7-security-update/117683 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-3820
https://notcve.org/view.php?id=CVE-2018-3820
Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Las versiones posteriores a la 6.1.0 y anteriores a la 6.1.3 de Kibana presentan una vulnerabilidad Cross-Site Scripting (XSS) en las visualizaciones de los labs que podrían permitir a un atacante obtener información sensible o realizar acciones destructivas en nombre de otros usuarios de Kibana. • https://discuss.elastic.co/t/elastic-stack-6-1-3-and-5-6-7-security-update/117683 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •