Kruskall

**Name of the Vulnerable Software and Affected Versions** Kibana (affected versions not specified) **Description** An authenticated user can cause a denial of service by submitting a specially crafted bulk deletion request. This leads to excessive resource consumption, which may render the application unavailable. This issue is caused by the allocation of resources without limits or throttling. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kibana (affected versions not specified) **Description** An issue exists where sensitive request header values may be recorded in application logs when the optional application performance monitoring (APM) instrumentation is enabled. This can lead to information disclosure, as the logged data may be accessible to operators with log access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Elasticsearch (affected versions not specified) **Description** An authenticated user can trigger a denial of service by submitting a specially crafted bulk request. This leads to uncontrolled resource consumption through excessive allocation, resulting in sustained high CPU usage that can render the affected node unable to process requests. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kibana (affected versions not specified) **Description** Improper output neutralization for logs allows for log injection. An attacker can provide specially crafted input that is written to log files without being properly neutralized. If these log files are viewed in a terminal that interprets control sequences, the injected content can alter the displayed log data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Elasticsearch versions prior to 8.19.17 Elasticsearch versions prior to 9.3.6 Elasticsearch versions prior to 9.4.3 **Description** An authenticated user can trigger a denial of service by submitting a specially crafted query. This occurs due to uncontrolled recursion, which leads to excessive resource allocation during request processing and may render the affected node unavailable. **Recommendations** Update to version 8.19.17. Update to version 9.3.6. Update to version 9.4.3.

**Name of the Vulnerable Software and Affected Versions** Elasticsearch (affected versions not specified) **Description** An issue exists where the allocation of resources lacks limits or throttling. A user with elevated privileges can submit a specially crafted machine learning request that triggers excessive memory consumption, potentially leading to a denial of service and rendering the affected node unavailable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Fleet Server (affected versions not specified) **Description** An issue exists where resources are allocated without limits or throttling. An attacker can send a specially crafted request to an upload endpoint, leading to excessive memory consumption. This condition can result in a denial of service, potentially rendering the server unavailable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kibana (affected versions not specified) **Description** Improper input validation in the Fleet policy management functionality allows an authenticated user to submit specially crafted input. This can lead to a denial of service, rendering the Fleet agent, server, and policy management features unavailable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Elastic Defend (affected versions not specified) **Description** Incorrect authorization allows a low-privileged authenticated user to access response action data they are not authorized to view. This occurs because functionality is not properly constrained by Access Control Lists (ACLs), which are sets of rules that define which users or system processes are granted access to specific objects. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.