CVE-2018-17244

MEDIUM Year: 2018
CVSS v3 Score
6.5
Medium
CVSS v2 Score
4.0
Medium
Weakness Type
CWE-362
View all →

Vulnerability Description

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; when used with run as, this can result in the request running as the incorrect user. This could allow a user to access information that they should not have access to.

Related Vulnerabilities

CVE-2020-1641

MEDIUM
CVSS:6.5(Medium)

A Race Condition vulnerability in Juniper Networks Junos OS LLDP implementation allows an attacker to cause LLDP to crash leading to a Denial of Service (DoS). This issue occurs when crafted LLDP pack...

CWE-3622020

CVE-2022-2160

MEDIUM
CVSS:6.5(Medium)

Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 103.0.5060.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive...

CWE-3622022

CVE-2023-20902

MEDIUM
CVSS:6.5(Medium)

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retr...

CWE-3622023

CVE-2023-46132

MEDIUM
CVSS:6.5(Medium)

Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linking" results in a molecule with a chemical formula that is com...

CWE-3622023

CVE-2024-11708

MEDIUM
CVSS:6.5(Medium)

Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affects Firefox < 133 and Thunderbird < 133.

CWE-3622024

CVE-2024-36621

MEDIUM
CVSS:6.5(Medium)

moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulti...

CWE-3622024