Splunk Enterprise.

Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise

• Splunk Enterprise
• CWE-687

Persistent Cross-site Scripting (XSS) in Dashboard Elements

• Splunk Enterprise
• Splunk Cloud Platform
• Cross-site scripting (XSS)

Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows

• Splunk Enterprise
• Insecure deserialization

Risky command safeguards bypass through Search ID query in Analytics Workspace

• Splunk Enterprise
• Splunk Cloud Platform
• Information disclosure

Command Injection using External Lookups

• Splunk Enterprise
• Splunk Cloud Platform
• Command injection

Information Disclosure of user names

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-204

Persistent Cross-site Scripting (XSS) in Dashboard Elements

• Splunk Enterprise
• Splunk Cloud Platform
• Cross-site scripting (XSS)

Low-privileged user could create notifications in Splunk Web Bulletin Messages

• Splunk Enterprise
• Splunk Cloud Platform
• Broken access control

Insecure File Upload in the indexing/preview REST endpoint

• Splunk Enterprise
• Splunk Cloud Platform
• Unrestricted file upload

Splunk Authentication Token Exposure in Debug Log in Splunk Enterprise

• Splunk Enterprise
• Information disclosure

Risky command safeguards bypass in Dashboard Examples Hub

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-20

Deserialization of Untrusted Data on Splunk Enterprise for Windows through Path Traversal from Separate Disk Partition

• Splunk Enterprise
• CWE-20

Sensitive Information Disclosure of Index Metrics through “mrollup” SPL Command

• Splunk Enterprise
• Splunk Cloud
• CWE-20

Server Response Disclosure in RapidDiag Salesforce.com Log File

• Splunk Enterprise
• Splunk Cloud
• Information disclosure

Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection Deletion

• Splunk Enterprise
• Splunk Cloud
• Broken access control

Cross-site Scripting (XSS) on “Show Syntax Highlighted” View in Search Page

• Splunk Enterprise
• Splunk Cloud
• Cross-site scripting (XSS)

Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing

• Splunk Enterprise
• Splunk Cloud
• Other injection

Absolute Path Traversal in Splunk Enterprise Using runshellscript.py

• Splunk Enterprise
• Splunk Cloud
• Path traversal

Splunk Enterprise on Windows Privilege Escalation due to Insecure OPENSSLDIR Build Definition Reference in DLL

• Splunk Enterprise
• CWE-665

Denial of Service (DoS) in Splunk Enterprise Using a Malformed SAML Request

• Splunk Enterprise
• Splunk Cloud
• Denial of service

Denial of Service (DoS) via the ‘printf’ Search Function

• Splunk Enterprise
• Splunk Cloud
• Denial of service

Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpoint

• Splunk Enterprise
• Splunk Cloud
• Cross-site scripting (XSS)

Remote Code Execution via Serialized Session Payload

• Splunk Enterprise
• Splunk Cloud
• Insecure deserialization

Command Injection in Splunk Enterprise Using External Lookups

• Splunk Enterprise
• Splunk Cloud
• Command injection

Low-privileged User can View Hashed Default Splunk Password

• Splunk Enterprise
• Splunk Cloud Platform
• Broken access control

‘edit_user’ Capability Privilege Escalation

• Splunk Enterprise
• Splunk Cloud Platform
• Broken access control

Unauthenticated Log Injection in Splunk Enterprise

• Splunk Enterprise
• Splunk Universal Forwarder
• Other injection

Denial of Service via the 'dump' SPL command

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-754

Information Disclosure via the ‘copyresults’ SPL Command

• Splunk Enterprise
• Splunk Cloud Platform
• Information disclosure

Role-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search Results

• Splunk Enterprise
• Splunk Cloud Platform
• Broken access control

Denial Of Service due to Untrusted XML Tag in XML Parser within SAML Authentication

• Splunk Enterprise
• Splunk Cloud Platform
• XML external entities (XXE)

Persistent Cross-Site Scripting (XSS) through a URL Validation Bypass within a Dashboard View

• Splunk Enterprise
• Cross-site scripting (XSS)

HTTP Response Splitting via the ‘rest’ SPL Command

• Splunk Enterprise
• Splunk Cloud Platform
• Other injection

SPL Command Safeguards Bypass via the ‘map’ SPL Command in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-20

Permissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• Broken access control

Unnecessary File Extensions Allowed by Lookup Table Uploads in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-20

Persistent Cross-Site Scripting through the ‘module’ Tag in a View in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• Cross-site scripting (XSS)

Cross-Site Request Forgery in the ‘ssg/kvstore_client’ REST Endpoint in Splunk Enterprise

• Splunk Enterprise
• Cross-site request forgery (CSRF)

Persistent Cross-Site Scripting through a Base64-encoded Image in a View in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• Cross-site scripting (XSS)

Authenticated Blind Server Side Request Forgery via the ‘search_listener’ Search Parameter in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• Server-side request forgery (SSRF)

Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-248

‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• Broken access control

SPL Command Safeguards Bypass via the ‘display.page.search.patterns.sensitivity’ Search Parameter in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-20

SPL Command Safeguards Bypass via the ‘pivot’ SPL Command in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-20

SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• CWE-20

Indexing blockage via malformed data sent through S2S or HEC protocols in Splunk Enterprise

• Splunk Enterprise
• Denial of service

XML External Entity Injection through a custom View in Splunk Enterprise

• Splunk Enterprise
• XML external entities (XXE)

Persistent Cross-Site Scripting via a Data Model object name in Splunk Enterprise

• Splunk Enterprise
• Cross-site scripting (XSS)

Reflected Cross-Site Scripting via the radio template in Splunk Enterprise

• Splunk Enterprise
• Cross-site scripting (XSS)

Remote Code Execution via the Splunk Secure Gateway application Mobile Alerts feature

• Splunk Enterprise
• Insecure deserialization

Risky command safeguards bypass via Search ID query in Analytics Workspace in Splunk Enterprise

• Splunk Enterprise
• CWE-20

Risky command safeguards bypass via ‘tstats command JSON in Splunk Enterprise

• Splunk Enterprise
• CWE-20

Denial of Service in Splunk Enterprise through search macros

• Splunk Enterprise
• Denial of service

Risky command safeguards bypass via rex search command field names in Splunk Enterprise

• Splunk Enterprise
• CWE-20

Host Header Injection in Splunk Enterprise

• Splunk Enterprise
• CWE-20

Remote Code Execution through dashboard PDF generation component in Splunk Enterprise

• Splunk Enterprise
• Code injection

Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise

• Splunk Enterprise
• Cross-site scripting (XSS)

Ingest Actions UI in Splunk Enterprise 9.0.0 disabled TLS certificate validation

• Splunk Enterprise
• Weak cryptography or TLS

Malformed ZIP file crashes Universal Forwarders and Splunk Enterprise through file monitoring input

• Splunk Enterprise
• Splunk Universal Forwarders
• CWE-409

Information disclosure via the dashboard drilldown in Splunk Enterprise

• Splunk Enterprise
• Splunk Cloud Platform
• Information disclosure