CVE-2025-20322

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, an unauthenticated attacker could send a specially-crafted SPL search command that could trigger a rolling restart in the Search Head Cluster...

CVE-2025-20322 Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk Enterprise

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, an unauthenticated attacker could send a specially-crafted SPL search command that could trigger a rolling restart in the Search Head Cluster...

CVE-2025-20321

The CVE-2025-20321 issue affects Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and 9.2.2406.119. It is a Cross-Site Request Forgery (CSRF) vulnerability that can change the membership state of a Splunk Search...

CVE-2025-20325

Summary: CVE-2025-20325 affects Splunk Enterprise <9.4.3, <9.3.5, <9.2.7, <9.1.10 and Splunk Cloud Platform <9.3.2411.103, <9.3.2408.113,

CVE-2025-20325 Sensitive Information Disclosure in the SHCConfig logging channel in Clustered Deployments in Splunk Enterprise

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the software potentially exposes the search head cluster splunk.secret key. This exposure could happen if you have a Search Head cluster and...

Splunk Enterprise 9.1.0 < 9.1.10, 9.2.0 < 9.2.7, 9.3.0 < 9.3.5, 9.4.0 < 9.4.3 (SVD-2025-0704)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-0704 advisory. - In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104,...

Splunk Enterprise 9.1.0 < 9.1.10, 9.2.0 < 9.2.7, 9.3.0 < 9.3.5, 9.4.0 < 9.4.3 (SVD-2025-0709)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-0709 advisory. - In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103,...

Malicious code in pupeteer-cluster-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1fe95354a3e77909ce12723e8b6920602c16294ebe131716c947de18ed799d18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5609 Malicious code in pupeteer-cluster-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1fe95354a3e77909ce12723e8b6920602c16294ebe131716c947de18ed799d18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Insecure Deserialization

com.typesafe.akka, akka-cluster-metrics is vulnerable to insecure deserialization. The vulnerability is due to the use of Java serialization without proper validation or safeguards in the akka-cluster-metrics module, which allows an attacker to exploit the deserialization process to execute...

CVE-2025-6017

A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials through the UI. This information should only be accessible to...

CVE-2025-6017 Rhacm: users with clusterreader role can see credentials from managed-clusters

A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials through the UI. This information should only be accessible to...

CVE-2025-6017 Rhacm: users with clusterreader role can see credentials from managed-clusters

A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials through the UI. This information should only be accessible to...

CVE-2025-6017

CVE-2025-6017 concerns Red Hat Advanced Cluster Management (RHACM) with affected versions 2.10 (before 2.10.7), 2.11 (before 2.11.4), and 2.12 (before 2.12.4). The vulnerability allows an unprivileged user to view confidential managed-cluster credentials via the UI, leading to potential informati...

CVE-2025-6017 Rhacm: users with clusterreader role can see credentials from managed-clusters

A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials through the UI. This information should only be accessible to...

CVE-2025-6017

A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials through the UI. This information should only be accessible to...

PT-2025-27605 · Red Hat · Red Hat Advanced Cluster Management

Name of the Vulnerable Software and Affected Versions: Red Hat Advanced Cluster Management versions 2.10 through 2.10.6 Red Hat Advanced Cluster Management versions 2.11 through 2.11.3 Red Hat Advanced Cluster Management versions 2.12 through 2.12.3 Description: A flaw in Red Hat Advanced Cluster...

Oracle Linux 10 : pcs (ELSA-2025-8319)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8319 advisory. 0.12.0-3.el100.2 - Rebased pcs to the latest sources see CHANGELOG.md Resolves: RHEL-7681, RHEL-21050, RHEL-22423, RHEL-35407, RHEL-44347, RHEL-63186,...

Red Hat Advanced Cluster Management 安全漏洞

Red Hat Advanced Cluster Management is a console cluster control software from Red Hat USA. A security vulnerability exists in Red Hat Advanced Cluster Management versions prior to 2.10.7, prior to 2.11.4, and prior to 2.12.4, which originates from an unauthorized user being able to view cluster...

The vulnerability of the orf_token_endian_convert() function in the community-based communication system for Corosync-resistant clusters allows a perpetrator to execute arbitrary code or cause a service failure.

The vulnerability of the orftokenendianconvert function in the cluster-based communication system for Corosync-resistant clusters is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a...