Advisories · Technology
Splunk Enterprise.
Every CVE that names Splunk Enterprise among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.1 High
Splunk Enterprise lacked TLS cert validation for Splunk-to-Splunk communication by default
- Splunk Enterprise
- Splunk Cloud Platform
- Weak cryptography or TLS
- CVSS 7.4 High
Splunk Enterprise and Universal Forwarder CLI connections lacked TLS cert validation
- Splunk Enterprise
- Splunk Universal Forwarder
- Weak cryptography or TLS
- CVSS 8.8 High
Reflected XSS in a query parameter of the Monitoring Console
- Splunk Enterprise
- Cross-site scripting (XSS)
- CVSS 8.8 High
Path Traversal in search parameter results in external content injection
- Splunk Enterprise
- CWE-20
- CVSS 4.3 Medium
Error message discloses internal path
- Splunk Enterprise
- Information disclosure
- CVSS 8.8 High
Local privilege escalation via a default path in Splunk Enterprise Windows
- Splunk Enterprise
- CWE-427
- CVSS 5.3 Medium
Username enumeration through lockout message in REST API
- Splunk Enterprise
- Information disclosure
- CVSS 7.5 High
S2S TcpToken authentication bypass
- Splunk Enterprise
- Authentication bypass
- CVSS 8.1 High
Bypass of Splunk Enterprise's implementation of DUO MFA
- Splunk Enterprise
- Authentication bypass
- CVSS 7.5 High
Indexer denial-of-service via malformed S2S request
- Splunk Enterprise
- Memory corruption