Persistent Cross-Site Scripting through a Base64-encoded Image in a View in Splunk Enterprise

Reflected Cross-Site Scripting via the radio template in Splunk Enterprise

Reflected XSS in a query parameter of the Monitoring Console

Remote Code Execution (RCE) through the REST API in Splunk Enterprise

Stored Cross-Site Scripting through Dashboard Sparkline Tooltip Options in Splunk Enterprise

Improper Input Validation through Classic Dashboard CSS in Splunk Enterprise

Improper Input Validation through Classic Dashboards in Splunk Enterprise

Information Disclosure through External Content Restriction Bypass in Splunk Enterprise

Improper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise

Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise

Risky Command Safeguards Bypass in “/app/search/search“ endpoint through “s“ parameter in Splunk Enterprise

Risky command safeguards bypass in “/services/streams/search“ endpoint through “q“ parameter in Splunk Enterprise

Sensitive Information Disclosure in Splunk Secure Gateway App

Risky command safeguards bypass in “/en-US/app/search/report“ endpoint through “s“ parameter

Risky command safeguards bypass through Search ID query in Analytics Workspace

SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise

Improper Access Control in Splunk Enterprise

Malformed ZIP file crashes Universal Forwarders and Splunk Enterprise through file monitoring input

Authorization Bypass in the Data Management REST API in Splunk Enterprise

Path Traversal through Knowledge Bundle Replication in Splunk Enterprise

Server-Side Request Forgery (SSRF) through the Report Notifications REST API in Splunk Secure Gateway

Stored Cross-Site Scripting (XSS) through Splunk Web Dashboard Sparkline Format Options in Splunk Enterprise

Risky Commands Safeguards Bypass through Splunk Web in Splunk Enterprise

Risky Commands Safeguards Bypass through Table Editor Dataset Initial Data in Splunk Enterprise

SPL Injection through the geostats Command in Splunk Enterprise

Stored Cross-Site Scripting (XSS) in Splunk Web Tours in Splunk Enterprise

Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise

Improper Access Control through the REST API in Splunk Enterprise

Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise

Sensitive Information Disclosure in Discover Splunk Observability Cloud app for Splunk Enterprise

URL validation bypass through Views Dashboard in Splunk Enterprise

Stored Cross-Site Scripting (XSS) through missing field warning messages in Saved Search and Job Inspector on Splunk Enterprise

Reflected Cross-site Scripting (XSS) in '/app/search/table' endpoint through the 'dataset.command' parameter on Splunk Enterprise

Improper Access Control in System Source Types Configuration in Splunk Enterprise

Reflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation component

Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise

Persistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk Enterprise

Persistent Cross-site Scripting (XSS) in Web Bulletin

Persistent Cross-site Scripting (XSS) in Dashboard Elements

Persistent Cross-site Scripting (XSS) in Dashboard Elements

Persistent Cross-Site Scripting (XSS) through a URL Validation Bypass within a Dashboard View

Persistent Cross-Site Scripting via a Data Model object name in Splunk Enterprise

Host Header Injection in Splunk Enterprise

Improper Access Control in Splunk Enterprise

Missing Authorization for Reloading Token-Signing Keys through the REST API in Splunk Enterprise

Path Traversal through Splunk Web Static File Serving in Splunk Enterprise

Unauthenticated Log Injection in Splunk Enterprise

Sensitive Information Disclosure in the SHCConfig logging channel in Clustered Deployments in Splunk Enterprise

Information Disclosure of user names

Server Response Disclosure in RapidDiag Salesforce.com Log File