Vulnerabilities > Splunk > Splunk > 6.0.0

DATE CVE VULNERABILITY TITLE RISK
2017-01-10 CVE-2016-10126 Permissions, Privileges, and Access Controls vulnerability in Splunk
Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3.x before 6.3.8, and 6.4.x before 6.4.4 allows remote attackers to conduct HTTP request injection attacks and obtain sensitive REST API authentication-token information via unspecified vectors, aka SPL-128840.
network
low complexity
splunk CWE-264
critical
 10.0
10
2015-08-18 CVE-2015-6515 Cross-site Scripting vulnerability in Splunk
Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.4, 6.1.x before 6.1.8, 6.0.x before 6.0.9, and 5.0.x before 5.0.13 and Splunk Light 6.2.x before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via a header.
network
splunk CWE-79
4.3
4.3
2014-10-16 CVE-2014-8302 Cross-Site Scripting vulnerability in Splunk
Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.1.x before 6.1.4, 6.0.x before 6.0.6, and 5.0.x before 5.0.10 allows remote attackers to inject arbitrary web script or HTML via vectors related to dashboard.
network
splunk CWE-79
3.5
3.5
2014-10-10 CVE-2014-3147 Cross-Site Scripting vulnerability in Splunk
Cross-site scripting (XSS) vulnerability in the auto-complete feature in Splunk Enterprise before 6.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a CSV file.
network
splunk CWE-79
3.5
3.5