# Splunk Enterprise. Every CVE that names Splunk Enterprise among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise](https://agentprime.io/advisories/CVE-2024-36985.md) `CVE-2024-36985` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Not analysed yet · Published 1 Jul 2024 · Tags: CWE-687 - [Persistent Cross-site Scripting (XSS) in Dashboard Elements](https://agentprime.io/advisories/CVE-2024-36992.md) `CVE-2024-36992` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Cross-site scripting (XSS) - [Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows](https://agentprime.io/advisories/CVE-2024-36984.md) `CVE-2024-36984` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Not analysed yet · Published 1 Jul 2024 · Tags: Insecure deserialization - [Risky command safeguards bypass through Search ID query in Analytics Workspace](https://agentprime.io/advisories/CVE-2024-36986.md) `CVE-2024-36986` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Information disclosure - [Command Injection using External Lookups](https://agentprime.io/advisories/CVE-2024-36983.md) `CVE-2024-36983` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 8.0 High · Not analysed yet · Published 1 Jul 2024 · Tags: Command injection - [Information Disclosure of user names](https://agentprime.io/advisories/CVE-2024-36996.md) `CVE-2024-36996` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: CWE-204 - [Persistent Cross-site Scripting (XSS) in Dashboard Elements](https://agentprime.io/advisories/CVE-2024-36994.md) `CVE-2024-36994` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Cross-site scripting (XSS) - [Low-privileged user could create notifications in Splunk Web Bulletin Messages](https://agentprime.io/advisories/CVE-2024-36989.md) `CVE-2024-36989` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Broken access control - [Insecure File Upload in the indexing/preview REST endpoint](https://agentprime.io/advisories/CVE-2024-36987.md) `CVE-2024-36987` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Unrestricted file upload - [Splunk Authentication Token Exposure in Debug Log in Splunk Enterprise](https://agentprime.io/advisories/CVE-2024-29945.md) `CVE-2024-29945` · CVE record: Splunk Splunk Enterprise · CVSS 7.2 High · Not analysed yet · Published 27 Mar 2024 · Tags: Information disclosure - [Risky command safeguards bypass in Dashboard Examples Hub](https://agentprime.io/advisories/CVE-2024-29946.md) `CVE-2024-29946` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Mar 2024 · Tags: CWE-20 - [Deserialization of Untrusted Data on Splunk Enterprise for Windows through Path Traversal from Separate Disk Partition](https://agentprime.io/advisories/CVE-2024-23678.md) `CVE-2024-23678` · CVE record: Splunk Splunk Enterprise · CVSS 7.5 High · Not analysed yet · Published 22 Jan 2024 · Tags: CWE-20 - [Sensitive Information Disclosure of Index Metrics through “mrollup” SPL Command](https://agentprime.io/advisories/CVE-2024-23676.md) `CVE-2024-23676` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.6 Medium · Not analysed yet · Published 22 Jan 2024 · Tags: CWE-20 - [Server Response Disclosure in RapidDiag Salesforce.com Log File](https://agentprime.io/advisories/CVE-2024-23677.md) `CVE-2024-23677` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 22 Jan 2024 · Tags: Information disclosure - [Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection Deletion](https://agentprime.io/advisories/CVE-2024-23675.md) `CVE-2024-23675` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Jan 2024 · Tags: Broken access control - [Cross-site Scripting (XSS) on “Show Syntax Highlighted” View in Search Page](https://agentprime.io/advisories/CVE-2023-46213.md) `CVE-2023-46213` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 16 Nov 2023 · Tags: Cross-site scripting (XSS) - [Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing](https://agentprime.io/advisories/CVE-2023-46214.md) `CVE-2023-46214` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 8.0 High · Critical (CVSS 7+ and EPSS) · EPSS 0.89 · Not analysed yet · Published 16 Nov 2023 · Tags: Other injection - [Absolute Path Traversal in Splunk Enterprise Using runshellscript.py](https://agentprime.io/advisories/CVE-2023-40597.md) `CVE-2023-40597` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 7.8 High · Not analysed yet · Published 30 Aug 2023 · Tags: Path traversal - [Splunk Enterprise on Windows Privilege Escalation due to Insecure OPENSSLDIR Build Definition Reference in DLL](https://agentprime.io/advisories/CVE-2023-40596.md) `CVE-2023-40596` · CVE record: Splunk Splunk Enterprise · CVSS 7.0 High · Not analysed yet · Published 30 Aug 2023 · Tags: CWE-665 - [Denial of Service (DoS) in Splunk Enterprise Using a Malformed SAML Request](https://agentprime.io/advisories/CVE-2023-40593.md) `CVE-2023-40593` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 30 Aug 2023 · Tags: Denial of service - [Denial of Service (DoS) via the ‘printf’ Search Function](https://agentprime.io/advisories/CVE-2023-40594.md) `CVE-2023-40594` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 30 Aug 2023 · Tags: Denial of service - [Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpoint](https://agentprime.io/advisories/CVE-2023-40592.md) `CVE-2023-40592` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 8.4 High · Not analysed yet · Published 30 Aug 2023 · Tags: Cross-site scripting (XSS) - [Remote Code Execution via Serialized Session Payload](https://agentprime.io/advisories/CVE-2023-40595.md) `CVE-2023-40595` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 8.8 High · Not analysed yet · Published 30 Aug 2023 · Tags: Insecure deserialization - [Command Injection in Splunk Enterprise Using External Lookups](https://agentprime.io/advisories/CVE-2023-40598.md) `CVE-2023-40598` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 8.5 High · Not analysed yet · Published 30 Aug 2023 · Tags: Command injection - [Low-privileged User can View Hashed Default Splunk Password](https://agentprime.io/advisories/CVE-2023-32709.md) `CVE-2023-32709` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 1 Jun 2023 · Tags: Broken access control - [‘edit_user’ Capability Privilege Escalation](https://agentprime.io/advisories/CVE-2023-32707.md) `CVE-2023-32707` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.79 · Not analysed yet · Published 1 Jun 2023 · Tags: Broken access control - [Unauthenticated Log Injection in Splunk Enterprise](https://agentprime.io/advisories/CVE-2023-32712.md) `CVE-2023-32712` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 8.6 High · Not analysed yet · Published 1 Jun 2023 · Tags: Other injection - [Denial of Service via the 'dump' SPL command](https://agentprime.io/advisories/CVE-2023-32716.md) `CVE-2023-32716` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 1 Jun 2023 · Tags: CWE-754 - [Information Disclosure via the ‘copyresults’ SPL Command](https://agentprime.io/advisories/CVE-2023-32710.md) `CVE-2023-32710` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 1 Jun 2023 · Tags: Information disclosure - [Role-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search Results](https://agentprime.io/advisories/CVE-2023-32717.md) `CVE-2023-32717` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 1 Jun 2023 · Tags: Broken access control - [Denial Of Service due to Untrusted XML Tag in XML Parser within SAML Authentication](https://agentprime.io/advisories/CVE-2023-32706.md) `CVE-2023-32706` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 7.7 High · Not analysed yet · Published 1 Jun 2023 · Tags: XML external entities (XXE) - [Persistent Cross-Site Scripting (XSS) through a URL Validation Bypass within a Dashboard View](https://agentprime.io/advisories/CVE-2023-32711.md) `CVE-2023-32711` · CVE record: Splunk Splunk Enterprise · CVSS 5.4 Medium · Not analysed yet · Published 1 Jun 2023 · Tags: Cross-site scripting (XSS) - [HTTP Response Splitting via the ‘rest’ SPL Command](https://agentprime.io/advisories/CVE-2023-32708.md) `CVE-2023-32708` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 7.2 High · Not analysed yet · Published 1 Jun 2023 · Tags: Other injection - [SPL Command Safeguards Bypass via the ‘map’ SPL Command in Splunk Enterprise](https://agentprime.io/advisories/CVE-2023-22939.md) `CVE-2023-22939` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 8.1 High · Not analysed yet · Published 14 Feb 2023 · Tags: CWE-20 - [Permissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk Enterprise](https://agentprime.io/advisories/CVE-2023-22938.md) `CVE-2023-22938` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Feb 2023 · Tags: Broken access control - [Unnecessary File Extensions Allowed by Lookup Table Uploads in Splunk Enterprise](https://agentprime.io/advisories/CVE-2023-22937.md) `CVE-2023-22937` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Feb 2023 · Tags: CWE-20 - [Persistent Cross-Site Scripting through the ‘module’ Tag in a View in Splunk Enterprise](https://agentprime.io/advisories/CVE-2023-22933.md) `CVE-2023-22933` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 8.0 High · Not analysed yet · Published 14 Feb 2023 · Tags: Cross-site scripting (XSS) - [Cross-Site Request Forgery in the ‘ssg/kvstore_client’ REST Endpoint in Splunk Enterprise](https://agentprime.io/advisories/CVE-2023-22942.md) `CVE-2023-22942` · CVE record: Splunk Splunk Enterprise · CVSS 5.4 Medium · Not analysed yet · Published 14 Feb 2023 · Tags: Cross-site request forgery (CSRF) - [Persistent Cross-Site Scripting through a Base64-encoded Image in a View in Splunk Enterprise](https://agentprime.io/advisories/CVE-2023-22932.md) `CVE-2023-22932` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 8.0 High · Not analysed yet · Published 14 Feb 2023 · Tags: Cross-site scripting (XSS) - [Authenticated Blind Server Side Request Forgery via the ‘search_listener’ Search Parameter in Splunk Enterprise](https://agentprime.io/advisories/CVE-2023-22936.md) `CVE-2023-22936` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 14 Feb 2023 · Tags: Server-side request forgery (SSRF) - [Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon](https://agentprime.io/advisories/CVE-2023-22941.md) `CVE-2023-22941` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Feb 2023 · Tags: CWE-248 - [‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk Enterprise](https://agentprime.io/advisories/CVE-2023-22931.md) `CVE-2023-22931` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 14 Feb 2023 · Tags: Broken access control - [SPL Command Safeguards Bypass via the ‘display.page.search.patterns.sensitivity’ Search Parameter in Splunk Enterprise](https://agentprime.io/advisories/CVE-2023-22935.md) `CVE-2023-22935` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 8.1 High · Not analysed yet · Published 14 Feb 2023 · Tags: CWE-20 - [SPL Command Safeguards Bypass via the ‘pivot’ SPL Command in Splunk Enterprise](https://agentprime.io/advisories/CVE-2023-22934.md) `CVE-2023-22934` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 7.3 High · Not analysed yet · Published 14 Feb 2023 · Tags: CWE-20 - [SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise](https://agentprime.io/advisories/CVE-2023-22940.md) `CVE-2023-22940` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 14 Feb 2023 · Tags: CWE-20 - [Indexing blockage via malformed data sent through S2S or HEC protocols in Splunk Enterprise](https://agentprime.io/advisories/CVE-2022-43572.md) `CVE-2022-43572` · CVE record: Splunk Splunk Enterprise · CVSS 7.5 High · Not analysed yet · Published 4 Nov 2022 · Tags: Denial of service - [XML External Entity Injection through a custom View in Splunk Enterprise](https://agentprime.io/advisories/CVE-2022-43570.md) `CVE-2022-43570` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Not analysed yet · Published 4 Nov 2022 · Tags: XML external entities (XXE) - [Persistent Cross-Site Scripting via a Data Model object name in Splunk Enterprise](https://agentprime.io/advisories/CVE-2022-43569.md) `CVE-2022-43569` · CVE record: Splunk Splunk Enterprise · CVSS 8.0 High · Not analysed yet · Published 4 Nov 2022 · Tags: Cross-site scripting (XSS) - [Reflected Cross-Site Scripting via the radio template in Splunk Enterprise](https://agentprime.io/advisories/CVE-2022-43568.md) `CVE-2022-43568` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.43 · Not analysed yet · Published 4 Nov 2022 · Tags: Cross-site scripting (XSS) - [Remote Code Execution via the Splunk Secure Gateway application Mobile Alerts feature](https://agentprime.io/advisories/CVE-2022-43567.md) `CVE-2022-43567` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Not analysed yet · Published 4 Nov 2022 · Tags: Insecure deserialization - [Risky command safeguards bypass via Search ID query in Analytics Workspace in Splunk Enterprise](https://agentprime.io/advisories/CVE-2022-43566.md) `CVE-2022-43566` · CVE record: Splunk Splunk Enterprise · CVSS 7.3 High · Not analysed yet · Published 4 Nov 2022 · Tags: CWE-20 - [Risky command safeguards bypass via ‘tstats command JSON in Splunk Enterprise](https://agentprime.io/advisories/CVE-2022-43565.md) `CVE-2022-43565` · CVE record: Splunk Splunk Enterprise · CVSS 8.1 High · Not analysed yet · Published 4 Nov 2022 · Tags: CWE-20 - [Denial of Service in Splunk Enterprise through search macros](https://agentprime.io/advisories/CVE-2022-43564.md) `CVE-2022-43564` · CVE record: Splunk Splunk Enterprise · CVSS 4.9 Medium · Not analysed yet · Published 4 Nov 2022 · Tags: Denial of service - [Risky command safeguards bypass via rex search command field names in Splunk Enterprise](https://agentprime.io/advisories/CVE-2022-43563.md) `CVE-2022-43563` · CVE record: Splunk Splunk Enterprise · CVSS 8.1 High · Not analysed yet · Published 4 Nov 2022 · Tags: CWE-20 - [Host Header Injection in Splunk Enterprise](https://agentprime.io/advisories/CVE-2022-43562.md) `CVE-2022-43562` · CVE record: Splunk Splunk Enterprise · CVSS 3.0 Low · Not analysed yet · Published 4 Nov 2022 · Tags: CWE-20 - [Remote Code Execution through dashboard PDF generation component in Splunk Enterprise](https://agentprime.io/advisories/CVE-2022-43571.md) `CVE-2022-43571` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.19 · Not analysed yet · Published 3 Nov 2022 · Tags: Code injection - [Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise](https://agentprime.io/advisories/CVE-2022-43561.md) `CVE-2022-43561` · CVE record: Splunk Splunk Enterprise · CVSS 6.4 Medium · Not analysed yet · Published 3 Nov 2022 · Tags: Cross-site scripting (XSS) - [Ingest Actions UI in Splunk Enterprise 9.0.0 disabled TLS certificate validation](https://agentprime.io/advisories/CVE-2022-37437.md) `CVE-2022-37437` · CVE record: Splunk Splunk Enterprise · CVSS 7.4 High · Not analysed yet · Published 16 Aug 2022 · Tags: Weak cryptography or TLS - [Malformed ZIP file crashes Universal Forwarders and Splunk Enterprise through file monitoring input](https://agentprime.io/advisories/CVE-2022-37439.md) `CVE-2022-37439` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 16 Aug 2022 · Tags: CWE-409 - [Information disclosure via the dashboard drilldown in Splunk Enterprise](https://agentprime.io/advisories/CVE-2022-37438.md) `CVE-2022-37438` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 2.6 Low · Not analysed yet · Published 16 Aug 2022 · Tags: Information disclosure Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .