Splunk Enterprise 6.6.x, when configured to run as root but drop privileges to a specific non-root account, allows local users to gain privileges by leveraging access to that…

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a user who holds a role that contains the high-privilege capability `edit_scripted` and `list_inputs`…

SPL Injection through Splunk Web in Splunk Enterprise

Improper Input Validation during User Account Creation in Splunk Enterprise

Server-Side Request Forgery (SSRF) through the REST API in Splunk App for Splunk Observability Cloud

Denial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk Enterprise

Structured Query Language (SQL) Injection in the SPL2 Module Catalog in Splunk Enterprise

Improper Access Control in Search Job Retrieval through the REST API in Splunk Enterprise

Improper Access Control through REST API Endpoints in Splunk Secure Gateway

Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise

SPL Injection through Cross-Site Request Forgery (CSRF) in the Event Type Builder in Splunk Web for Splunk Enterprise

Insecure Default Access Control List through the REST API in Splunk Secure Gateway

Incorrect Permission Assignment for Critical Resource through the REST API in Splunk Enterprise

Use of Hard-coded Cryptographic Key through Companion App Registration in Splunk Secure Gateway

Missing Authorization through REST API Endpoints in Splunk Secure Gateway

Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise

Sensitive Information Disclosure through Log Files in Splunk Enterprise

Denial of Service through coldToFrozen.sh Script in Splunk Enterprise

Sensitive Information Disclosure through Improper Access Control in Splunk Enterprise

Sensitive Information Disclosure in MongoClient logging channel in Splunk Enterprise

Improper Access Control in Splunk Monitoring Console App

Improper Input Validation in "label" column field in Splunk Secure Gateway App

Incorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgrade

Incorrect permission assignment on Splunk Enterprise for Windows during new installation or upgrade

Improper Access Control in Background Job Submission in Splunk Enterprise

Extensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk Enterprise

In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a…

In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the…

In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does…

In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a…

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an authenticated, low-privileged user that does not hold the…

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the…

In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming…

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, an attacker can exploit a vulnerability in the {{dump}} SPL…

On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an unauthenticated attacker can send specially-crafted messages to the XML parser within SAML authentication to…

Indexing blockage via malformed data sent through S2S or HEC protocols in Splunk Enterprise

XML External Entity Injection through a custom View in Splunk Enterprise

Denial of Service in Splunk Enterprise through search macros

Directory traversal vulnerability in the Splunk Django App in Splunk Enterprise 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.14, 6.3.x before 6.3.10, 6.4.x before…

Splunk Web in Splunk Enterprise versions 6.5.x before 6.5.2, 6.4.x before 6.4.5, 6.3.x before 6.3.9, 6.2.x before 6.2.13, 6.1.x before 6.1.12, 6.0.x before 6.0.13, 5.0.x before…

SPL Injection through Splunk Web Form Tokens in Splunk Enterprise

SPL Injection through Dashboard Studio Workflow Actions in Splunk Enterprise

SPL Injection through Monitoring Console Dashboard Inputs in Splunk Enterprise

SPL Injection through Splunk Web in Splunk Secure Gateway

Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gateway

Stored Cross-Site Scripting (XSS) through Path Traversal in Splunk Enterprise

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an…

Cross-Site Scripting (XSS) through Splunk Web Message Validation in Splunk Enterprise

Open Redirect on Web Login endpoint in Splunk Enterprise

In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XSS) on the…