Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
splunk splunk 9.0.0 vulnerabilities and exploits
(subscribe to this query)
3.5
CVSSv3
CVE-2022-37438
In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information (for example, username, email, and real name) about Splunk users, when visited by another user through the drilldown component. The vulnerabil...
Splunk Splunk 9.0.0
Splunk Splunk Cloud Platform
Splunk Splunk
9.8
CVSSv3
CVE-2022-37437
When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service (S3) in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Splunk Enterprise and an...
Splunk Splunk 9.0.0
8.1
CVSSv3
CVE-2022-32154
Dashboards in Splunk Enterprise versions prior to 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to ...
Splunk Splunk
Splunk Splunk Cloud Platform
9.1
CVSSv3
CVE-2022-32151
The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default in Splunk Enterprise versions prior to 9.0 and Splunk Cloud Platform versions prior to 8.2.2203. Pyt...
Splunk Splunk
Splunk Splunk Cloud Platform
7.2
CVSSv3
CVE-2022-32152
Splunk Enterprise peers in Splunk Enterprise versions prior to 9.0 and Splunk Cloud Platform versions prior to 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates ...
Splunk Splunk
Splunk Splunk Cloud Platform
8.1
CVSSv3
CVE-2022-32153
Splunk Enterprise peers in Splunk Enterprise versions prior to 9.0 and Splunk Cloud Platform versions prior to 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates ...
Splunk Splunk
Splunk Splunk Cloud Platform
7.5
CVSSv3
CVE-2022-32155
In universal forwarder versions prior to 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environ...
Splunk Splunk
Splunk Splunk Cloud Platform
8.1
CVSSv3
CVE-2022-32156
In Splunk Enterprise and Universal Forwarder versions prior to 9.0, the Splunk command-line interface (CLI) did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation fo...
Splunk Splunk
Splunk Universal Forwarder
7.5
CVSSv3
CVE-2022-32157
Splunk Enterprise deployment servers in versions prior to 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients (https://docs.splunk.com/D...
Splunk Splunk
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injection
CVE-2006-4304
CVE-2023-26603
CVE-2024-28327
CVE-2023-50363
CVE-2024-21905
template injection
CVE-2024-3400
cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started