The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default…

Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk Enterprise

Command Injection using External Lookups

In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting…

In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the…

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘display.page.search.patterns.sensitivity’ search parameter lets a search bypass SPL safeguards for risky…

Remote Code Execution via the Splunk Secure Gateway application Mobile Alerts feature

Risky command safeguards bypass via ‘tstats command JSON in Splunk Enterprise

Risky command safeguards bypass via rex search command field names in Splunk Enterprise

Remote Code Execution through dashboard PDF generation component in Splunk Enterprise

SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise

Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint

Risky command safeguards bypass in Dashboard Examples Hub

Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin…

Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk…

Remote Code Execution through file upload to “$SPLUNK_HOME/var/run/splunk/apptemp“ directory in Splunk Enterprise

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands using a…

Risky command safeguards bypass via Search ID query in Analytics Workspace in Splunk Enterprise

Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise

Sensitive Information Disclosure through SPL commands

Denial of Service through null pointer reference in “cluster/config” REST endpoint

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise…

In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST…

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd)

In universal forwarder versions before 9.0, management services are available remotely by default

Denial of Service (DoS) through “User Interface - Views“ configuration page in Splunk Enterprise

Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise

Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise

Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk…

Improper Handling and Insufficient Isolation of Specific Temporary Files in Splunk Enterprise

Improper Input Validation during User Account Creation in Splunk Enterprise

Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise

Sensitive Information Disclosure through Log Files in Splunk Enterprise

Denial of Service through coldToFrozen.sh Script in Splunk Enterprise

Sensitive Information Disclosure through Improper Access Control in Splunk Enterprise

Sensitive Information Disclosure in MongoClient logging channel in Splunk Enterprise

Improper Input Validation in "label" column field in Splunk Secure Gateway App

Improper Access Control in Background Job Submission in Splunk Enterprise

Extensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk Enterprise

Maintenance mode state change of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise

Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app

Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon

Denial of Service (DoS) on the datamodel/web REST endpoint

Insecure File Upload in the indexing/preview REST endpoint

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, an attacker can exploit a vulnerability in the {{dump}} SPL…