PT-2014-8451

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 5.0.x through 5.0.9 Splunk Enterprise versions 6.0.x through 6.0.5 Splunk Enterprise versions 6.1.x through 6.1.3 Description A cross-site scripting XSS issue exists in Splunk Web, allowing remote attackers to inject...

PT-2014-8450

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 5.0.x through 5.0.9 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the HTTP Referer header. This affects Splunk Web in Splunk Enterprise...

CVE-2014-8301: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Splunk Web in Splunk Enterprise 5.0.x before 5.0.10 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header...

CVE-2014-8302: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Splunk Web in Splunk Enterprise 6.1.x before 6.1.4, 6.0.x before 6.0.6, and 5.0.x before 5.0.10 allows remote attackers to inject arbitrary web script or HTML via vectors related to dashboard...

PT-2014-8452

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 6.0.x through 6.0.5 Splunk Enterprise versions 6.1.x through 6.1.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via vectors related to event...

CVE-2014-3147

Cross-site scripting XSS vulnerability in the auto-complete feature in Splunk Enterprise before 6.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a CSV file...

Cross site scripting

Cross-site scripting XSS vulnerability in the auto-complete feature in Splunk Enterprise before 6.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a CSV file...

CVE-2014-3147

Cross-site scripting XSS vulnerability in the auto-complete feature in Splunk Enterprise before 6.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a CSV file...

CVE-2014-3147: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the auto-complete feature in Splunk Enterprise before 6.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a CSV file...

PT-2014-5114

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 6.0.4 Description The issue is related to a cross-site scripting XSS vulnerability in the auto-complete feature. This allows remote authenticated users to inject arbitrary web script or HTML via a CSV file...

Splunk Enterprise 6.1.x < 6.1.3 Multiple Vulnerabilities

According to its version number, the Splunk Enterprise hosted on the remote web server is 6.1.x prior to 6.1.3. It is, therefore, affected by the following vulnerabilities : - A path traversal vulnerability exists due to a flaw related to search IDs, in which user input is not properly sanitized....

CVE-2014-5197

Splunk Enterprise 6.1.x before 6.1.3 is affected by a directory traversal (CVE-2014-5197) in Splunk Web and the Splunkd HTTP Server. The vulnerability allows remote authenticated users to read arbitrary files via a .. in a URI, related to search IDs. Impact is read access to local files; no expli...

CVE-2014-5198

The CVE-2014-5198 entry concerns Splunk Enterprise 6.1.x prior to 6.1.3 where an XSS vulnerability exists in Splunk Web. The root cause is improper handling/validation of the Referer header, allowing remote attackers to inject arbitrary web script or HTML in the victim’s browser. Affected compone...

PT-2014-6336

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 6.1.0 through 6.1.2 Description The issue allows remote authenticated users to read arbitrary files via a .. dot dot in a URI, related to search ids. This is a directory traversal vulnerability in Splunk Web or the...

CVE-2014-5197: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in 1 Splunk Web or the 2 Splunkd HTTP Server in Splunk Enterprise 6.1.x before 6.1.3 allows remote authenticated users to read arbitrary files via a .. dot dot in a URI, related to search ids...

CVE-2014-5198: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Splunk Web in Splunk Enterprise 6.1.x before 6.1.3 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header...

PT-2014-6337

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 6.1.x through 6.1.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the Referer HTTP header. This affects Splunk Web in Splunk Enterprise...

Splunk Enterprise 4.3.x / 5.0.x < 5.0.9 / 6.0.x < 6.0.5 / 6.1.x < 6.1.2 Multiple OpenSSL Vulnerabilities

According to its version number, the Splunk Enterprise hosted on the remote web server is 4.3.x, 5.0.x prior to 5.0.9, 6.0.x prior to 6.0.5, or 6.1.x prior to 6.1.2. It is, therefore, affected by multiple OpenSSL-related vulnerabilities : - An unspecified error exists that allows an attacker to...

Splunk Enterprise 6.x < 6.0.1 Malformed Packet DoS

According to its version number, the Splunk Enterprise hosted on the remote web server may be affected by a denial of service vulnerability that is triggered by malformed network input, resulting in the Splunk server becoming unavailable. Note that this only affects Splunk Enterprise 6.0 componen...

Splunk Enterprise / Free Detection (HTTP)

HTTP based detection Splunk Enterprise / Free. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...