patch-CVE-2026-28001

补丁：CVE-2026-28001 漏洞详情 CVE ：CVE-2026-28001 产品 ：Splunk Enterprise 描述 ：SPL 解析中的远程代码执行 严重级别 ：严重 补丁状态：已部署 字段| 值 ---|--- 补丁日期| 2026-07-22 状态| 已部署 部署至| 生产环境 验证人员| SecOps 团队 参考链接 NVD CISA KEV...

CVE-2026-20253

Splunk Enterprise — CVE-2026-20253 トレーニングラボ Splunk Enterprise 10.2.3 · PostgreSQL リカバリーサイドカー · CWE-306 重要な機能に対する認証の欠如 認可された自己完結型の再現であり、防御教育のために実際のアドバイザリをモデル化 しています。Splunkのプロプライエタリコードは含まれていません。 このリポジトリは、Vulhub/DVWAスタイルのセキュリティトレーニングラボです。Splunk Enterprise 10.2.3 の忠実なモデルを立ち上げ、CVE-2026-20253...

CVE-2026-20251

CVE-2026-20251 — Splunk Secure Gateway jsonpickle デシリアライゼーション RCE 研究者: Fady Oueslati · ReactiveZero Security Research 参照: 2026FO-SPLUNK-20251 CVSS: 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ステータス: 公開中 — パッチ提供済み 概要 低権限の認証済みユーザーが、KV ストア（mobilealerts コレクション）に細工されたドキュメントを保存することで、Splunk ホスト上で...

watchTowr-vs-Splunk-CVE-2026-20253

CVE-2026-20253 Splunk Pre-Auth RCE Splunk Pre-Auth RCE 1day 検出アーティファクト生成ツール 動作中の検出 検出アーティファクト生成ツールは、PostgreSQL Sidecar Service の /v1/postgres/recovery/backup エンドポイントにアクセスし、アクセス可能かどうかを確認します: 400 応答 - おそらく脆弱 401 応答 - おそらく脆弱ではない それ以外 - PostgreSQL Sidecar Service...

CVE-2026-20253

🚨 CVE-2026-20253 - 중요한 Splunk Enterprise 무인증 파일 생성 취약점 Splunk Enterprise 및 Splunk Cloud Platform에 영향을 미치는 무인증 임의 파일 생성 및 잘라내기 취약점 📖 요약 CVE-2026-20253 은 Splunk Enterprise 및 Splunk Cloud Platform의 중요한 취약점으로, 노출된 PostgreSQL 사이드카 서비스 엔드포인트를 통해 인증되지 않은 원격 공격자가 임의 파일을 생성하거나 잘라낼 수 있습니다. 취약한 기능에 인증 제어가 없...

CVE-2026-20253

CVE-2026-20253 — Splunk Enterprise Pre-Auth RCE ラボ PostgreSQL サイドカーを介した認証なしの任意ファイル作成および切り詰め CVSS 9.8 · Critical · CWE-306 · 積極的に悪用中（CISA KEV） ⚠️ 免責事項 このリポジトリは教育および許可されたセキュリティ研究の目的に限定 して提供されています。 すべてのテストは、自分が所有する、またはテストするための明示的な書面による許可を得たインフラストラクチャに対してのみ実施してください。 ここで紹介する技術やツールの誤用について、著者は一切の責任を負いません...

SOC-Analyst-Portfolio

🛡️ Allen Ace SOC Analyst | Threat Hunter | Detection Engineer Detect • Investigate • Respond • Defend Welcome This portfolio documents my hands-on cybersecurity journey through practical investigations, enterprise lab environments, detection engineering, digital forensics, malware analysis, threat...

CVE-2024-36991

CVE-2024-36991: Windows의 Splunk Enterprise 버전 9.2.2, 9.1.5, 9.0.10 미만에 영향을 미치는 경로 탐색 취약점 비동기 성능을 갖춘 CVE-2024-36991 취약점 탐지 및 익스플로잇 도구 CVEHunter 설치 git clone https://github.com/th3gokul/CVE-2024-36991.git cd CVE-2024-36991 pip install -r requirements.txt python3 cvehunter.py --help 🚀 사용법 python3...

CVE-2024-36991

CVE-2024-36991 Windows 환경의 Splunk Enterprise 9.2.2, 9.1.5, 9.0.10 미만 버전에서 민감한 파일을 읽을 수 있는 경로 탐색 취약점...

CVE-2023-32707

CVE-2023-32707 exploitdb에 보고된 CVE를 기반으로 개선된 POC 익스플로잇 Exploit Title: Splunk 9.0.5 - Admin Account Takeover CVE: CVE-2023-32707 개요 이 스크립트는 Splunk 9.0.5의 취약점을 악용하여 관리자 계정 탈취를 가능하게 합니다. 익스플로잇은 edituser 권한을 가진 낮은 권한의 사용자를 활용하여 권한을 상승시킵니다. 사전 요구 사항 Python 3.x 필요한 Python 패키지 pip3 install -r...

Astra Linux – Vulnerability in Ansible

Ansible versions 2.9.x before 2.9.1, 2.8.x before 2.8.7, and 2.7.x before 2.7.15 do not respect the “nolog” flag set to True when using Sumologic and Splunk callback plugins to send task result events to collectors. This could lead to the disclosure and collection of sensitive data...

Exploit for Missing Authentication for Critical Function in Splunk

CVE-2026-20253 Lab Environment Splunk Enterprise Pre-Auth R...

HTSOC

HTSOC — Integrated SOC System for Event Monitoring, Detection, and Investigation HTSOC is a self-built Security Operations Center system in a lab environment. The system combines log collection, detection with Splunk, alert/case management with TheHive, Observable analysis with Cortex, IOC lookup...

detection-defense-library — Updated!

Detection Defense Library One defense-engineering library, consolidated. Attack classes, the patterns that detect them, the committed Sigma rules, and the Windows trust-boundary model, all in a single repo. This repo folds in five former sibling repositories: Former repo| Folded into| What it hol...

Splunk Enterprise’s vulnerabilities are exploited through Splunk

Splunk has identified several vulnerabilities in Splunk Enterprise, particularly in versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. These vulnerabilities include: - Inadequate enforcement of authentication and authorization checks in REST APIs, allowing unauthorized users to access sensitiv...

CVE-2026-76355

creationtimestamp| type| source ---|---|--- 2026-08-20 04:47:20+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76354

creationtimestamp| type| source ---|---|--- 2026-08-20 04:47:18+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-24 17:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtts42qkba2u...

CVE-2026-76353

creationtimestamp| type| source ---|---|--- 2026-08-20 04:47:16+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76352

creationtimestamp| type| source ---|---|--- 2026-08-20 04:47:14+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-22 18:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtow75jsbr24...

CVE-2026-76351

creationtimestamp| type| source ---|---|--- 2026-08-20 04:47:11+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 00:00:08+00:00| published-proof-of-concept| Telegram/87w5sTCGBPeMw8h3c2UBbBkEJEqeSW1iUUAENsR3qsz5w 2026-08-22...