Filtered by vendor Elastic Subscriptions
Total 185 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-25010 1 Elastic 1 Kibana 2025-08-29 6.5 Medium
Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces.
CVE-2025-25011 1 Elastic 1 Elastic Beats 2025-08-02 7 High
An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.
CVE-2025-0712 1 Elastic 1 Apm Server 2025-07-31 7 High
An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.
CVE-2015-1427 2 Elastic, Redhat 4 Elasticsearch, Fuse, Jboss Amq and 1 more 2025-07-30 9.8 Critical
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
CVE-2019-7609 2 Elastic, Redhat 3 Kibana, Openshift, Openshift Container Platform 2025-07-30 9.8 Critical
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
CVE-2024-52973 1 Elastic 1 Kibana 2025-07-14 6.5 Medium
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana.
CVE-2024-52974 1 Elastic 1 Kibana 2025-07-13 6.5 Medium
An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permissions for Observability assigned to them.
CVE-2024-12556 1 Elastic 1 Kibana 2025-07-13 8.7 High
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.
CVE-2024-52980 1 Elastic 1 Elasticsearch 2025-07-13 6.5 Medium
A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.
CVE-2024-52972 1 Elastic 1 Kibana 2025-07-13 6.5 Medium
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.
CVE-2024-52979 1 Elastic 1 Elasticsearch 2025-07-13 6.5 Medium
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
CVE-2025-25014 1 Elastic 1 Kibana 2025-07-13 9.1 Critical
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.
CVE-2024-52976 1 Elastic 1 Elastic Agent 2025-07-13 4.4 Medium
Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitrary code via parameter injection. An attacker requires local access and the ability to modify osqueryd configurations.
CVE-2024-11390 1 Elastic 1 Kibana 2025-07-13 5.4 Medium
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.
CVE-2024-43708 1 Elastic 1 Kibana 2025-07-13 6.5 Medium
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana.
CVE-2024-23445 1 Elastic 1 Elasticsearch 2025-07-13 6.5 Medium
It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#security-api-create-cross-cluster-api-key-request-body  restricts search for a given index using the query or the field_security parameter, and the same cross-cluster API key also grants replication for the same index, the search restrictions are not enforced during cross cluster search operations and search results may include documents and terms that should not be returned. This issue only affects the API key based security model for remote clusters https://www.elastic.co/guide/en/elasticsearch/reference/8.14/remote-clusters.html#remote-clusters-security-models  that was previously a beta feature and is released as GA with 8.14.0
CVE-2024-52975 1 Elastic 1 Fleet Server 2025-07-13 9 Critical
An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log levels. The nature of the sensitive information largely depends on the integrations enabled.
CVE-2024-11994 1 Elastic 1 Apm Server 2025-07-13 5.7 Medium
APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document, this could disclose sensitive information in APM Server error logs.
CVE-2024-43707 1 Elastic 1 Kibana 2025-07-12 7.7 High
An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.
CVE-2025-25015 1 Elastic 1 Kibana 2025-07-12 9.9 Critical
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors