Splunk Cloud Platform.

Command Injection using External Lookups

• Splunk Enterprise
• Splunk Cloud Platform
• Command injection

Information Disclosure of user names

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-204

Persistent Cross-site Scripting (XSS) in Dashboard Elements

• Splunk Enterprise
• Splunk Cloud Platform
• Cross-site scripting (XSS)

Low-privileged user could create notifications in Splunk Web Bulletin Messages

• Splunk Enterprise
• Splunk Cloud Platform
• Broken access control

Insecure File Upload in the indexing/preview REST endpoint

• Splunk Enterprise
• Splunk Cloud Platform
• Unrestricted file upload

Risky command safeguards bypass in Dashboard Examples Hub

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-20

Low-privileged User can View Hashed Default Splunk Password

• Splunk Enterprise
• Splunk Cloud Platform
• Broken access control

‘edit_user’ Capability Privilege Escalation

• Splunk Enterprise
• Splunk Cloud Platform
• Broken access control

Denial of Service via the 'dump' SPL command

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-754

Information Disclosure via the ‘copyresults’ SPL Command

• Splunk Enterprise
• Splunk Cloud Platform
• Information disclosure

Role-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search Results

• Splunk Enterprise
• Splunk Cloud Platform
• Broken access control

Denial Of Service due to Untrusted XML Tag in XML Parser within SAML Authentication

• Splunk Enterprise
• Splunk Cloud Platform
• XML external entities (XXE)

HTTP Response Splitting via the ‘rest’ SPL Command

• Splunk Enterprise
• Splunk Cloud Platform
• Other injection

SPL Command Safeguards Bypass via the ‘map’ SPL Command in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-20

Permissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• Broken access control

Unnecessary File Extensions Allowed by Lookup Table Uploads in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-20

Persistent Cross-Site Scripting through the ‘module’ Tag in a View in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• Cross-site scripting (XSS)

Persistent Cross-Site Scripting through a Base64-encoded Image in a View in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• Cross-site scripting (XSS)

Authenticated Blind Server Side Request Forgery via the ‘search_listener’ Search Parameter in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• Server-side request forgery (SSRF)

Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-248

‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• Broken access control

SPL Command Safeguards Bypass via the ‘display.page.search.patterns.sensitivity’ Search Parameter in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-20

SPL Command Safeguards Bypass via the ‘pivot’ SPL Command in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-20

SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-20

Information disclosure via the dashboard drilldown in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• Information disclosure

Splunk Enterprise lacked TLS cert validation for Splunk-to-Splunk communication by default

• Splunk Enterprise
• Splunk Cloud Platform
• Weak cryptography or TLS