11 results (0.003 seconds)

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2020-2143

https://notcve.org/view.php?id=CVE-2020-2143

09 Mar 2020 — Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure. Jenkins Logstash Plugin versiones 2.3.1 y anteriores, transmite las credenciales configuradas en texto plano como parte de su formulario de configuración de Jenkins global, resultando potencialmente en su exposición. • http://www.openwall.com/lists/oss-security/2020/03/09/1 • CWE-319: Cleartext Transmission of Sensitive Information •

CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0

CVE-2019-7612

https://notcve.org/view.php?id=CVE-2019-7612

25 Mar 2019 — A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message. Se ha encontrado un error de divulgación de datos sensibles en la manera en la que las versiones de Logstash anteriores a las 5.6.15 y 6.6.1 registran URL mal formadas. Si una URL mal formada forma parte de la configuración del LogStash... • https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 • CWE-209: Generation of Error Message Containing Sensitive Information CWE-532: Insertion of Sensitive Information into Log File •

CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0

CVE-2018-3817

https://notcve.org/view.php?id=CVE-2018-3817

30 Mar 2018 — When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive information. Cuando se registran avisos sobre configuraciones obsoletas, Logstash en versiones anteriores a la 5.6.6 y 6.x anteriores a la 6.1.2 podría registrar de manera inadvertida información sensible. • https://discuss.elastic.co/t/elastic-stack-6-1-2-and-5-6-6-security-update/115763 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •

CVSS: 7.8EPSS: 0%CPEs: 18EXPL: 0

CVE-2017-14730

https://notcve.org/view.php?id=CVE-2017-14730

25 Sep 2017 — The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to a $LS_USER account for creation of a hard link. El script init en el paquete app-admin/logstash-bin de Gentoo en versiones anteriores a la 5.5.3 y las versiones 5.6.x anteriores a la 5.6.1 tiene llamadas "chown -R" para árboles de directorio escribibles por los usuarios, lo que permite que ... • https://bugs.gentoo.org/628558 • CWE-732: Incorrect Permission Assignment for Critical Resource •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2016-10363

https://notcve.org/view.php?id=CVE-2016-10363

16 Jun 2017 — Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5, Netflow v9 or IPFIX packets could perform a denial of service attack on the Logstash instance. The errors resulting from these crafted inputs are not handled by the codec and can cause the Logstash process to exit. Logstash en versiones anteriores a la 2.3.3, cuando se usa el plugin Netflow Codec plugin, un atacante remoto modificando maliciosamente Netflow v5, Netflow v9 o paquetes IPFIX ... • https://www.elastic.co/community/security • CWE-248: Uncaught Exception CWE-404: Improper Resource Shutdown or Release •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2016-1000221

https://notcve.org/view.php?id=CVE-2016-1000221

16 Jun 2017 — Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information. En la versión anterior de Logstash en su versión 2.3.4, el plugin Elasticsearch Output registraría en las cabeceras de autorización de archivos HTTP, los cuales podrían contener información sensible. • http://www.securityfocus.com/bid/99126 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2016-1000222

https://notcve.org/view.php?id=CVE-2016-1000222

16 Jun 2017 — Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data. En la versión anterior de Logstash en su versión 2.1.2, la salida de un CSV puede ser atacada mediante una entrada ingeniada la cual puede crear formula maliciosas en los datos del CSV. • https://www.elastic.co/community/security • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •

CVSS: 5.9EPSS: 0%CPEs: 9EXPL: 0

CVE-2015-5619 – Logstash 1.5.3 Man-In-The-Middle

https://notcve.org/view.php?id=CVE-2015-5619

23 Aug 2015 — Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack. Logstash en versiones 1.4.x anteriores a la 1.4.5 y en versiones 1.5.x anteriores a la 1.5.4 con salida Lumberjack o el redireccionador Logstash no valida certificados SSL/TLS desde el servidor Logstash, lo que podría permitir que atacantes obtuviesen inf... • http://packetstormsecurity.com/files/133269/Logstash-1.5.3-Man-In-The-Middle.html • CWE-295: Improper Certificate Validation •

CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0

CVE-2015-5378 – Logstash 1.5.2 SSL/TLS FREAK

https://notcve.org/view.php?id=CVE-2015-5378

21 Jul 2015 — Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read communications between Logstash Forwarder agent and Logstash server. Logstash 1.5.x versiones anteriores a 1.5.3 y 1.4.x anteriores a 1.4.4 permite a atacantes remotos leer las comunicaciones entre el agente Logstash Forwarder y el servidor Logstash. Logstash 1.5.2 and prior versions are vulnerable to a SSL/TLS security issue called the FREAK attack. If you are using the Lumberjack input, FREAK allows an attacker to successfu... • http://packetstormsecurity.com/files/132800/Logstash-1.5.2-SSL-TLS-FREAK.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-4152 – Logstash 1.4.2 Directory Traversal

https://notcve.org/view.php?id=CVE-2015-4152

10 Jun 2015 — Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option. Vulnerabilidad de salto de directorio en el plugin file output en Elasticsearch Logstash anterior a 1.4.3 permite a atacantes remotos escribir en ficheros arbitrarios a través de vectores relacionados con referencia a campos dinámicos en la opción de rutas. Logstash versions 1.4.2 and prior a... • http://packetstormsecurity.com/files/132233/Logstash-1.4.2-Directory-Traversal.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •