Vulnerabilities > Splunk
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-06-02 | CVE-2022-27781 | Infinite Loop vulnerability in multiple products libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation. | 7.5 |
| 2022-06-02 | CVE-2022-27782 | Improper Certificate Validation vulnerability in multiple products libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. | 7.5 |
| 2022-06-02 | CVE-2022-30115 | Cleartext Transmission of Sensitive Information vulnerability in multiple products Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. | 4.3 |
| 2022-05-26 | CVE-2022-22576 | Missing Authentication for Critical Function vulnerability in multiple products An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. | 8.1 |
| 2022-05-06 | CVE-2021-26253 | Unspecified vulnerability in Splunk A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6. | 8.1 |
| 2022-05-06 | CVE-2021-31559 | Unspecified vulnerability in Splunk A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. | 7.5 |
| 2022-05-06 | CVE-2021-33845 | Information Exposure Through Discrepancy vulnerability in Splunk The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. | 5.3 |
| 2022-05-06 | CVE-2021-42743 | Uncontrolled Search Path Element vulnerability in Splunk A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions before 8.1.1 on Windows. | 7.8 |
| 2022-05-06 | CVE-2022-26070 | Information Exposure Through an Error Message vulnerability in Splunk When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise local system path. | 4.3 |
| 2022-05-06 | CVE-2022-26889 | Path Traversal vulnerability in Splunk 8.1.0/8.1.1 In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. | 8.8 |