Splunk vulnerabilities
347 CVEs and advisories name Splunk as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-45739Sensitive information disclosure in AdminManager logging channel
- CVE-2024-45738Sensitive information disclosure in REST_Calls logging channel
- CVE-2024-45737Maintenance mode state change of App Key Value Store (KVStore) through Cross-Site Request Forgery (CSRF)
- CVE-2024-45733Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows
- CVE-2024-45732Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app
- CVE-2024-45736Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon
- CVE-2024-45741Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise
- CVE-2024-45734Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard
- CVE-2024-45740Persistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk Enterprise
- CVE-2024-45731Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk
- CVE-2024-45735Improper Access Control for low-privileged user in Splunk Secure Gateway App
- CVE-2024-36997Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint
- CVE-2024-36993Persistent Cross-site Scripting (XSS) in Web Bulletin
- CVE-2024-36995Low-privileged user could create experimental items
- CVE-2024-36982Denial of Service through null pointer reference in “cluster/config” REST endpoint
- CVE-2024-36991Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows
- CVE-2024-36990Denial of Service (DoS) on the datamodel/web REST endpoint
- CVE-2024-36985Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise
- CVE-2024-36992Persistent Cross-site Scripting (XSS) in Dashboard Elements
- CVE-2024-36984Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows
- CVE-2024-36986Risky command safeguards bypass through Search ID query in Analytics Workspace
- CVE-2024-36983Command Injection using External Lookups
- CVE-2024-36996Information Disclosure of user names
- CVE-2024-36994Persistent Cross-site Scripting (XSS) in Dashboard Elements
- CVE-2024-36989Low-privileged user could create notifications in Splunk Web Bulletin Messages
- CVE-2024-36987Insecure File Upload in the indexing/preview REST endpoint
- CVE-2024-29945Splunk Authentication Token Exposure in Debug Log in Splunk Enterprise
- CVE-2024-29946Risky command safeguards bypass in Dashboard Examples Hub
- CVE-2023-46230Sensitive Information Disclosure to Internal Log Files in Splunk Add-on Builder
- CVE-2023-46231Session Token Disclosure to Internal Log Files in Splunk Add-on Builder