https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:52:27 +0000 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0304 certfr-2025-avi-0304 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0304 https://cve.radiocsirt.org/vuln/euvd-2026-51608 EUVD-2026-51608 https://cve.radiocsirt.org/vuln/euvd-2026-51608 https://cve.radiocsirt.org/vuln/fkie_cve-2019-7611 <p>A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index.</p> <p>A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-7611 https://cve.radiocsirt.org/vuln/ghsa-fj32-6v7m-57pg <p><strong>Affected:</strong> Maven: org.elasticsearch:elasticsearch</p> <p>A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index.</p> <p><strong>Affected:</strong> Maven: org.elasticsearch:elasticsearch</p> <p>A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index.</p> https://cve.radiocsirt.org/vuln/ghsa-fj32-6v7m-57pg https://cve.radiocsirt.org/vuln/gsd-2019-7611 gsd-2019-7611 https://cve.radiocsirt.org/vuln/gsd-2019-7611 https://cve.radiocsirt.org/vuln/rhsa-2020:0895 <p>mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure. elasticsearch: Improper permission issue when attaching a new name to an index jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig jackson-databind: Serialization gadgets in classes of the commons-configuration package jackson-databind: Serialization gadgets in classes of the xalan package jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource jackson-databind: Serialization gadgets in classes of the ehcache package jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*</p> <p>mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure. elasticsearch: Improper permission issue when attaching a new name to an index jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig jackson-databind: Serialization gadgets in classes of the commons-configuration package jackson-databind: Serialization gadgets in classes of the xalan package jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource jackson-databind: Serialization gadgets in classes of the ehcache package jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*</p> https://cve.radiocsirt.org/vuln/rhsa-2020:0895