https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 10:46:18 +0000 https://cve.radiocsirt.org/vuln/bit-elk-2024-11390 <p><strong>Affected:</strong> Bitnami: elk</p> <p>Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.</p> <p>The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.</p> <p><strong>Affected:</strong> Bitnami: elk</p> <p>Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.</p> <p>The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.</p> https://cve.radiocsirt.org/vuln/bit-elk-2024-11390 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0359 certfr-2025-avi-0359 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0359 https://cve.radiocsirt.org/vuln/euvd-2026-236209 EUVD-2026-236209 https://cve.radiocsirt.org/vuln/euvd-2026-236209 https://cve.radiocsirt.org/vuln/fkie_cve-2024-11390 <p>Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.</p> <p>The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.</p> <p>Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.</p> <p>The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-11390 https://cve.radiocsirt.org/vuln/ghsa-mv8v-9jrg-2c2w <p>Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.</p> <p>The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.</p> <p>Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files.</p> <p>The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.</p> https://cve.radiocsirt.org/vuln/ghsa-mv8v-9jrg-2c2w https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0917 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder Daten zu manipulieren.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0917