Vulnerabilities > Splunk

DATE CVE VULNERABILITY TITLE RISK
2023-03-30 CVE-2023-27538 Improper Authentication vulnerability in multiple products
An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. 		5.5
5.5
2023-02-23 CVE-2023-23914 Cleartext Transmission of Sensitive Information vulnerability in multiple products
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially.
network
low complexity
haxx netapp splunk CWE-319
critical
 9.1
9.1
2023-02-23 CVE-2023-23915 Cleartext Transmission of Sensitive Information vulnerability in multiple products
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel.
network
low complexity
haxx netapp splunk CWE-319
6.5
6.5
2023-02-23 CVE-2023-23916 Allocation of Resources Without Limits or Throttling vulnerability in multiple products
An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms.
network
low complexity
haxx fedoraproject debian netapp splunk CWE-770
6.5
6.5
2023-02-14 CVE-2023-22931 Incorrect Default Permissions vulnerability in Splunk and Splunk Cloud Platform
In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions.
network
low complexity
splunk CWE-276
4.3
4.3
2023-02-14 CVE-2023-22932 Cross-site Scripting vulnerability in Splunk and Splunk Cloud Platform
In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting (XSS) through the error message in a Base64-encoded image.
network
low complexity
splunk CWE-79
6.1
6.1
2023-02-14 CVE-2023-22933 Cross-site Scripting vulnerability in Splunk and Splunk Cloud Platform
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting (XSS) in an extensible mark-up language (XML) View through the ‘layoutPanel’ attribute in the ‘module’ tag’.
network
low complexity
splunk CWE-79
6.1
6.1
2023-02-14 CVE-2023-22934 Unspecified vulnerability in Splunk and Splunk Cloud Platform
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands using a saved search job.
network
low complexity
splunk
8.0
8.0
2023-02-14 CVE-2023-22935 Command Injection vulnerability in Splunk and Splunk Cloud Platform
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘display.page.search.patterns.sensitivity’ search parameter lets a search bypass SPL safeguards for risky commands.
network
low complexity
splunk CWE-77
8.8
8.8
2023-02-14 CVE-2023-22936 Server-Side Request Forgery (SSRF) vulnerability in Splunk and Splunk Cloud Platform
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an authenticated user.
network
low complexity
splunk CWE-918
6.3
6.3