MEDIUM Severity CVEs

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and eleme

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bo

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write.

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a deni

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an integer error when pro

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path t

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to resource exhaustion.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitializ

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper processing of DR

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information and perform unauthorized oper

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small docu

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request conta

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API en

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kiba

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied inpu

Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an interva

Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memor

Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive A

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Access

A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive A

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against El

Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on manag

Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Co

Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive All

Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipu

Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management function

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive All

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive All

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Fu

Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc

The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manage

Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153).

Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Exces