Filtered by vendor Splunk
Subscriptions
Total
211 CVE
CVE | Vendors | Products | Updated | CVSS v3.1 |
---|---|---|---|---|
CVE-2023-32709 | 1 Splunk | 2 Splunk, Splunk Cloud Platform | 2024-12-10 | 4.3 Medium |
In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user’ role can see the hashed version of the initial user name and password for the Splunk instance by using the ‘rest’ SPL command against the ‘conf-user-seed’ REST endpoint. | ||||
CVE-2023-32708 | 1 Splunk | 2 Splunk, Splunk Cloud Platform | 2024-12-10 | 7.2 High |
In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the ‘rest’ SPL command that lets them potentially access other REST endpoints in the system arbitrarily. | ||||
CVE-2023-40595 | 1 Splunk | 2 Splunk, Splunk Cloud Platform | 2024-12-10 | 8.8 High |
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code. | ||||
CVE-2024-23678 | 1 Splunk | 1 Splunk | 2024-12-10 | 7.5 High |
In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerability only affects Splunk Enterprise for Windows. | ||||
CVE-2023-40597 | 1 Splunk | 2 Splunk, Splunk Cloud Platform | 2024-12-10 | 7.8 High |
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk. | ||||
CVE-2023-46231 | 1 Splunk | 1 Add-on Builder | 2024-12-10 | 8.8 High |
In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the Splunk Add-on Builder or when you build or edit a custom app or add-on. | ||||
CVE-2024-45741 | 1 Splunk | 3 Splunk, Splunk Cloud Platform, Splunk Enterprise | 2024-12-10 | 5.4 Medium |
In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a malicious payload through a custom configuration file that the "api.uri" parameter from the "/manager/search/apps/local" endpoint in Splunk Web calls. This could result in execution of unauthorized JavaScript code in the browser of a user. | ||||
CVE-2024-45732 | 1 Splunk | 3 Splunk, Splunk Cloud Platform, Splunk Enterprise | 2024-12-10 | 7.1 High |
In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data. | ||||
CVE-2023-22934 | 1 Splunk | 2 Splunk, Splunk Cloud Platform | 2024-12-10 | 7.3 High |
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands using a saved search job. The vulnerability requires an authenticated user to craft the saved job and a higher privileged user to initiate a request within their browser. | ||||
CVE-2024-36982 | 1 Splunk | 4 Cloud, Splunk, Splunk Cloud Platform and 1 more | 2024-12-10 | 7.5 High |
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash of the Splunk daemon. | ||||
CVE-2023-32710 | 1 Splunk | 2 Splunk, Splunk Cloud Platform | 2024-12-10 | 4.8 Medium |
In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can perform an unauthorized transfer of data from a search using the ‘copyresults’ command if they know the search ID (SID) of a search job that has recently run. | ||||
CVE-2024-45736 | 1 Splunk | 3 Splunk, Splunk Cloud Platform, Splunk Enterprise | 2024-12-10 | 6.5 Medium |
In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query with an improperly formatted "INGEST_EVAL" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd). | ||||
CVE-2024-36992 | 1 Splunk | 2 Splunk, Splunk Cloud Platform | 2024-12-10 | 5.4 Medium |
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that could result in execution of unauthorized JavaScript code in the browser of a user. The “url” parameter of the Dashboard element does not have proper input validation to reject invalid URLs, which could lead to a Persistent Cross-site Scripting (XSS) exploit. | ||||
CVE-2023-32706 | 1 Splunk | 2 Splunk, Splunk Cloud Platform | 2024-12-10 | 7.7 High |
On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an unauthenticated attacker can send specially-crafted messages to the XML parser within SAML authentication to cause a denial of service in the Splunk daemon. | ||||
CVE-2023-22941 | 1 Splunk | 2 Splunk, Splunk Cloud Platform | 2024-12-10 | 6.5 Medium |
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd). | ||||
CVE-2023-40596 | 2 Microsoft, Splunk | 2 Windows, Splunk | 2024-12-10 | 7 High |
In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and subsequently install malicious code to achieve privilege escalation on the Windows machine. | ||||
CVE-2024-23675 | 1 Splunk | 2 Cloud, Splunk | 2024-12-10 | 6.5 Medium |
In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections. | ||||
CVE-2024-45737 | 1 Splunk | 2 Splunk, Splunk Cloud Platform | 2024-12-10 | 4.3 Medium |
In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF). | ||||
CVE-2024-36993 | 1 Splunk | 2 Splunk, Splunk Cloud Platform | 2024-12-10 | 5.4 Medium |
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a Splunk Web Bulletin Messages that could result in execution of unauthorized JavaScript code in the browser of a user. | ||||
CVE-2023-40592 | 1 Splunk | 2 Splunk, Splunk Cloud Platform | 2024-12-10 | 8.4 High |
In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XSS) on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk platform instance. |