Splunk Cloud (Splunk) - vulnerabilities (CVEs)
11 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2024-01-22. Vendor: Splunk.
CVEs of Splunk Cloud
- CVE-2024-23676 - CVSS 4.6 (medium), 2024-01-22: In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to…
- CVE-2024-23675 - CVSS 6.5 (medium), 2024-01-22: In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST…
- CVE-2024-23677 - CVSS 5.3 (medium), 2024-01-22: In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file.
- CVE-2023-46213 - CVSS 4.8 (medium), 2023-11-16: In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized…
- CVE-2023-46214 - CVSS 8.8 (high), 2023-11-16: In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that…
- CVE-2023-40598 - CVSS 8.8 (high), 2023-08-30: In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker…
- CVE-2023-40597 - CVSS 8.8 (high), 2023-08-30: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is…
- CVE-2023-40595 - CVSS 8.8 (high), 2023-08-30: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize…
- CVE-2023-40594 - CVSS 7.5 (high), 2023-08-30: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against…
- CVE-2023-40593 - CVSS 7.5 (high), 2023-08-30: In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the…
- CVE-2023-40592 - CVSS 8.4 (high), 2023-08-30: In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting…
