Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
splunk cloud vulnerabilities and exploits
(subscribe to this query)
9.1
CVSSv3
CVE-2022-32151
The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default in Splunk Enterprise versions prior to 9.0 and Splunk Cloud Platform versions prior to 8.2.2203. Pyt...
Splunk Splunk
Splunk Splunk Cloud Platform
8.1
CVSSv3
CVE-2022-32153
Splunk Enterprise peers in Splunk Enterprise versions prior to 9.0 and Splunk Cloud Platform versions prior to 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates ...
Splunk Splunk
Splunk Splunk Cloud Platform
7.5
CVSSv3
CVE-2022-32155
In universal forwarder versions prior to 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environ...
Splunk Splunk
Splunk Splunk Cloud Platform
6.1
CVSSv3
CVE-2023-22932
In Splunk Enterprise 9.0 versions prior to 9.0.4, a View allows for Cross-Site Scripting (XSS) through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0.
Splunk Splunk Cloud Platform
Splunk Splunk
8
CVSSv3
CVE-2023-22934
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands using a saved search job. The vulnerability requires an authenticated user to craft the saved job...
Splunk Splunk
Splunk Splunk Cloud Platform
8.8
CVSSv3
CVE-2023-22935
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘display.page.search.patterns.sensitivity’ search parameter lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within thei...
Splunk Splunk
Splunk Splunk Cloud Platform
4.3
CVSSv3
CVE-2023-22937
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table upload feature let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now be one of the following only: .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gzl.
Splunk Splunk
Splunk Splunk Cloud Platform
8.8
CVSSv3
CVE-2023-22939
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and...
Splunk Splunk
Splunk Splunk Cloud Platform
7.5
CVSSv3
CVE-2023-22941
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd).
Splunk Splunk
Splunk Splunk Cloud Platform
4.3
CVSSv3
CVE-2023-22931
In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions. This feature has been deprecated and disabled by default.
Splunk Splunk Cloud Platform
Splunk Splunk
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
SSRF
server-side request forgery
CVE-2024-30067
CVE-2024-5553
CVE-2024-30095
IDOR
CVE-2024-35252
CVE-2024-23692
CVE-2024-27801
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
NEXT »