High

DATE	CVE	VULNERABILITY TITLE	RISK
2024-03-27	CVE-2024-29946	Command Injection vulnerability in Splunk In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. network low complexity splunk CWE-77	8.1
2024-01-30	CVE-2023-46231	Information Exposure Through Log Files vulnerability in Splunk Add-On Builder 4.1.0/4.1.1/4.1.2 In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the Splunk Add-on Builder or when you build or edit a custom app or add-on. network low complexity splunk CWE-532	7.2
2024-01-22	CVE-2024-23678	Unspecified vulnerability in Splunk In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. local low complexity splunk	8.8
2023-11-16	CVE-2023-46214	XML Injection (aka Blind XPath Injection) vulnerability in Splunk Cloud and Splunk In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. network low complexity splunk CWE-91	8.8
2023-08-30	CVE-2023-40593	Unspecified vulnerability in Splunk and Splunk Cloud Platform In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon. network low complexity splunk	7.5
2023-08-30	CVE-2023-40594	Unspecified vulnerability in Splunk and Splunk Cloud Platform In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance. network low complexity splunk	7.5
2023-08-30	CVE-2023-40595	Deserialization of Untrusted Data vulnerability in Splunk and Splunk Cloud Platform In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data. network low complexity splunk CWE-502	8.8
2023-08-30	CVE-2023-40596	Uncontrolled Search Path Element vulnerability in Splunk In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. local low complexity splunk CWE-427	8.8
2023-08-30	CVE-2023-40597	Path Traversal vulnerability in Splunk and Splunk Cloud Platform In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk. local low complexity splunk CWE-22	8.8
2023-08-30	CVE-2023-40598	Missing Authentication for Critical Function vulnerability in Splunk In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. network low complexity splunk CWE-306	8.8