Unauthenticated Log Injection in Splunk Enterprise

Sensitive Information Disclosure in the SHCConfig logging channel in Clustered Deployments in Splunk Enterprise

Information Disclosure of user names

In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can perform an unauthorized transfer…

The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message

Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key

Sensitive Information Disclosure in "_internal" index in Splunk Enterprise

Sensitive Information Disclosure in "_internal" index in Splunk Enterprise

Sensitive Information Disclosure in ''_internal'' index in Splunk Enterprise

Denial of Service (DoS) through Multiple LDAP Bind Requests in Splunk Enterprise

Sensitive information disclosure in AdminManager logging channel

Sensitive information disclosure in REST_Calls logging channel

Stored Cross-Site scripting (XSS) through Anchor Tag "href" in Navigation Bar Collections in Splunk Enterprise

In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web…

Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise

Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2, with exploitation…

Cross-site scripting vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise…

Cross-site scripting vulnerability in Splunk Enterprise 6.3.x prior to 6.3.5 and Splunk Light 6.3.x prior to 6.3.5 allows attacker with administrator rights to inject arbitrary…

Improper Input Validation of Index Names through the collect Command in Splunk Enterprise

Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise

Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise

Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise

Improper Input Validation through the collect Command in Splunk Enterprise

Missing Access Control through the REST API in Splunk Secure Gateway

Log Injection through the REST API in Splunk App for Splunk O11y Cloud

Improper Authorization through the REST API in Splunk Enterprise

Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise

Information Exposure through REST API Endpoints in Splunk Secure Gateway

Improper Access Control in Data Model Acceleration in Splunk Enterprise

Client-Side Denial of Service (DoS) through ''/splunkd/__raw/services/authentication/users/username'' REST API endpoint in Splunk Enterprise

Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app

Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk Enterprise

Missing Access Control of Saved Searches in the Splunk Archiver app

Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise

Improper Access Control Lets Low-Privilege Users Suppress Read-Only Alerts in Splunk Enterprise

Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard Studio

Information Disclosure due to Username Collision with a Role that has the same Name as the User

Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard

Improper Access Control for low-privileged user in Splunk Secure Gateway App

Low-privileged user could create notifications in Splunk Web Bulletin Messages

On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the…

In Splunk Enterprise versions below 9.0.5, 8.2.11

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a…

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table upload feature let a user upload lookup tables with unnecessary filename extensions

In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without…

When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path

Splunk before 5.0.4 lacks X-Frame-Options which can allow Clickjacking

Improper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterprise