Elastic
Elastic 的公开漏洞报告、类别分布与常见资产。
14公开报告
$15,000披露赏金
9漏洞类别
10主要弱点
攻击面
弱点类别分布
主要弱点
常见资产
- cloud.elastic.coURL · 4
- *.swiftype.comWILDCARD · 2
- KibanaDOWNLOADABLE_EXECUTABLES · 2
- OtherOTHER · 2
- Fleet ServerDOWNLOADABLE_EXECUTABLES · 1
- *.elastic.coWILDCARD · 1
- Elastic Enterprise SearchDOWNLOADABLE_EXECUTABLES · 1
- Elastic Synthetics MonitoringOTHER · 1
高票报告
当前状态 14 份 · 全部 14
- 157Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)跨站脚本 · 2021-08-17 · 高危$0DOM 型 XSS
- 75CVE-2021-40870 on [52.204.160.31]代码执行 · 2021-10-07 · 严重$0代码注入
- 64Critical || Unrestricted access to private Github repos and properties of Elastic through leaked token of Elastic employee信息泄露 · 2021-09-02 · 严重$0敏感信息明文存储
- 54blind Server-Side Request Forgery (SSRF) allows scanning internal ports服务端请求伪造 · 2023-05-05 · 中危$0SSRF
- 47Synthetics Recorder: Code injection when recording website with malicious content代码执行 · 2023-04-09 · 高危$0代码注入
- 35CSRF in AppSearch allows creation of "curations"跨站请求伪造 · 2022-11-17 · 中危$0跨站请求伪造
- 25RCE hazard in reporting (via Chromium)访问控制 · 2021-05-26 · 严重$10,000权限提升
- 21Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine Access访问控制 · 2021-08-04 · 高危$0访问控制缺陷（通用）
- 14Remote Code Execution in coming Kibana 7.7.0访问控制 · 2021-04-20 · 严重$5,000权限提升
- 13Default password on 34.120.209.175密码学缺陷 · 2022-11-18 · 中危$0Weak Cryptography for Passwords
- 13Improper authorization on `/api/as/v1/credentials/` allows any App Search user to access all API keys and escalate privileges访问控制 · 2021-06-03 · 高危$0访问控制缺陷（通用）
- 10Fix for CVE-2021-22151 (Kibana path traversal issue) can be bypassed on Windows路径遍历 · 2021-11-16 · 低危$0路径遍历
- 9XXE in Enterprise Search's App Search web crawler注入与走私 · 2021-04-29 · 严重$0XXE
- 7[Swiftype] - Stored XSS via document field `url` triggers on `https://app.swiftype.com/engines/<engine>/document_types/<type>/documents/<id>`跨站脚本 · 2021-08-04 · 高危$0存储型 XSS