Filtered by vendor Elastic Subscriptions
Filtered by product Kibana Subscriptions

Search

Switch to Advanced Search (Beta)
Total 75 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-8452 1 Elastic 1 Kibana 2025-04-20 N/A
Kibana versions prior to 5.2.1 configured for SSL client access, file descriptors will fail to be cleaned up after certain requests and will accumulate over time until the process crashes.
CVE-2017-8439 1 Elastic 1 Kibana 2025-04-20 N/A
Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.
CVE-2017-8451 1 Elastic 1 Kibana 2025-04-20 N/A
With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.
CVE-2017-8443 1 Elastic 1 Kibana 2025-04-20 N/A
In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the credentials will appear in the URL bar. The credentials could then be viewed by untrusted parties or logged into the Kibana access logs.
CVE-2015-4093 1 Elastic 1 Kibana 2025-04-12 N/A
Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2015-8131 1 Elastic 1 Kibana 2025-04-12 N/A
Cross-site request forgery (CSRF) vulnerability in Elasticsearch Kibana before 4.1.3 and 4.2.x before 4.2.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2024-12556 1 Elastic 1 Kibana 2025-04-10 8.7 High
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.
CVE-2024-52974 1 Elastic 1 Kibana 2025-04-08 6.5 Medium
An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permissions for Observability assigned to them.
CVE-2022-38778 2 Decode-uri-component Project, Elastic 2 Decode-uri-component, Kibana 2025-03-25 6.5 Medium
A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process.
CVE-2024-37279 1 Elastic 1 Kibana 2025-03-13 4.3 Medium
A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries.
CVE-2024-43708 1 Elastic 1 Kibana 2025-02-12 6.5 Medium
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana.
CVE-2023-31414 1 Elastic 1 Kibana 2025-01-29 8.8 High
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.
CVE-2023-31415 1 Elastic 1 Kibana 2025-01-29 9.9 Critical
Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.
CVE-2024-43707 1 Elastic 1 Kibana 2025-01-23 7.7 High
An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.
CVE-2024-52972 1 Elastic 1 Kibana 2025-01-23 6.5 Medium
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.
CVE-2024-52973 1 Elastic 1 Kibana 2025-01-21 6.5 Medium
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana.
CVE-2021-22150 1 Elastic 1 Kibana 2024-12-02 6.6 Medium
It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server.
CVE-2024-37281 1 Elastic 1 Kibana 2024-11-21 6.5 Medium
An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint.
CVE-2024-23446 1 Elastic 1 Kibana 2024-11-21 6.5 Medium
An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.
CVE-2024-23443 1 Elastic 1 Kibana 2024-11-21 4.9 Medium
A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.