CVE-2025-20368

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through the error messages and job inspection...

CVE-2025-20368

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through the error messages and job inspection...

CVE-2025-20368

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through the error messages and job inspection...

CVE-2025-20368 Stored Cross-Site Scripting (XSS) through missing field warning messages in Saved Search and Job Inspector on Splunk Enterprise

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through the error messages and job inspection...

PT-2025-40271

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.4.4 Splunk Enterprise versions 9.2.8 through 9.3.6 Splunk Cloud Platform versions prior to 9.3.2411.108 Splunk Cloud Platform versions 9.2.2406.123 through 9.3.2408.118 Description A user with limited...

Linux Distros Unpatched Vulnerability : CVE-2017-5944

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The dashboard subscription interface in Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users...

CVE-2023-27151

openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number in the Saved Search Activity via the Name, Description, or Activity Number field...

CVE-2025-20232

In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208 and 9.1.2308.212, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command...

CVE-2025-20226

In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a saved search with a risky command using the permission...

CVE-2025-20226

CVE-2025-20226 affects Splunk Enterprise and Splunk Cloud Platform. A low-privileged user (not admin/power) can bypass SPL safeguards on the /services/streams/search endpoint via the q parameter and execute a risky command using higher-privilege permissions after phishing the victim. Affected ver...

CVE-2024-54447 Blind SQLi in Saved Search

Saved search functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain...

CVE-2024-54447

CVE-2024-54447 affects the LogicalDOC product where the saved search functionality contains a blind SQL injection. The issue can be exploited by authenticated users using a time-based blind SQLi technique to disclose all database contents. Depending on the presence or absence of entries in certai...

LogicalDOC SQL注入漏洞

LogicalDOC is the United States LogicalDOC company a set of document management system developed using Java technology. The system has features such as Lucene full-text search indexing and automatic import. A security vulnerability exists in LogicalDOC, which stems from a saved search function th...

CVE-2024-53244

In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.2.2406.107, 9.2.2403.109, and 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a...

CVE-2023-27151

openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number in the Saved Search Activity via the Name, Description, or Activity Number field...

CVE-2023-27151

openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number in the Saved Search Activity via the Name, Description, or Activity Number field...

Design/Logic Flaw

openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number in the Saved Search Activity via the Name, Description, or Activity Number field...

CVE-2023-27151

openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number in the Saved Search Activity via the Name, Description, or Activity Number field...

CVE-2023-27151

CVE-2023-27151 affects openCRX 5.2.0, where an HTML injection vulnerability exists in the Saved Search Activity’s Search Criteria - specifically via the Name, Description, or Activity Number fields. The cited sources describe a vulnerability in the OpenCRX application and note an HTML injection t...

UBUNTU-CVE-2023-43813

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perform a SQL injection. Version 10.0.11 contains a patch for the issue...