Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
splunk splunk cloud platform vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2023-40593
In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.
Splunk Splunk Cloud Platform
Splunk Splunk
NA
CVE-2023-40598
In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execut...
Splunk Splunk
Splunk Splunk Cloud Platform
445
VMScore
CVE-2022-32155
In universal forwarder versions prior to 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environ...
Splunk Splunk
Splunk Splunk Cloud Platform
570
VMScore
CVE-2022-32151
The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default in Splunk Enterprise versions prior to 9.0 and Splunk Cloud Platform versions prior to 8.2.2203. Pyt...
Splunk Splunk
Splunk Splunk Cloud Platform
578
VMScore
CVE-2022-32152
Splunk Enterprise peers in Splunk Enterprise versions prior to 9.0 and Splunk Cloud Platform versions prior to 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates ...
Splunk Splunk
Splunk Splunk Cloud Platform
605
VMScore
CVE-2022-32153
Splunk Enterprise peers in Splunk Enterprise versions prior to 9.0 and Splunk Cloud Platform versions prior to 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates ...
Splunk Splunk
Splunk Splunk Cloud Platform
356
VMScore
CVE-2022-32154
Dashboards in Splunk Enterprise versions prior to 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to ...
Splunk Splunk
Splunk Splunk Cloud Platform
NA
CVE-2022-37438
In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information (for example, username, email, and real name) about Splunk users, when visited by another user through the drilldown component. The vulnerabil...
Splunk Splunk 9.0.0
Splunk Splunk Cloud Platform
Splunk Splunk
NA
CVE-2023-40592
In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XSS) on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of a...
Splunk Splunk Cloud Platform
Splunk Splunk 9.1.0
Splunk Splunk
NA
CVE-2023-40594
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance.
Splunk Splunk Cloud Platform
Splunk Splunk 9.1.0
Splunk Splunk
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-3201
CVE-2024-4779
CVE-2024-35090
CVE-2024-5084
hard-coded
CVE-2024-4985
HTML injection
CVE-2024-33655
local file inclusion
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
NEXT »