The vulnerability of the web service journal of the Splunk Enterprise platform for operational analysis allows a perpetrator to execute arbitrary code.

The vulnerability of the log service of the Splunk Enterprise platform for operational analysis is related to the improper processing of log output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted HTTP request containing ANSI...

Code injection

In Splunk IT Service Intelligence ITSI versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject American National Standards Institute ANSI escape codes into Splunk ITSI log files that, when a vulnerable terminal application reads them, can run malicious code in the vulnerable...

Splunk 注入漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. It is used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. Splunk has an injection vulnerability that stems...

CVE-2023-4571: Improper Output Neutralization for Logs

In Splunk IT Service Intelligence ITSI versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject American National Standards Institute ANSI escape codes into Splunk ITSI log files that, when a vulnerable terminal application reads them, can run malicious code in the vulnerable...

PT-2023-29657 · Splunk · Splunk It Service Intelligence

Name of the Vulnerable Software and Affected Versions: Splunk IT Service Intelligence ITSI versions prior to 4.13.3 Splunk IT Service Intelligence ITSI versions prior to 4.15.3 Splunk IT Service Intelligence ITSI versions prior to 4.17.1 Description: A malicious actor can inject American National...

CVE-2023-32712

In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute ANSI escape codes into Splunk log files that, when a vulnerable terminal application reads them, can potentially, at worst, result in possible code execution in the...

CVE-2023-32712

In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute ANSI escape codes into Splunk log files that, when a vulnerable terminal application reads them, can potentially, at worst, result in possible code execution in the...

Code injection

In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute ANSI escape codes into Splunk log files that, when a vulnerable terminal application reads them, can potentially, at worst, result in possible code execution in the...

CVE-2023-32712

The CVE-2023-32712 issue affects Splunk Enterprise and Universal Forwarder as described in multiple sources. Affected Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2 allow injecting ANSI escape codes into log files, which a vulnerable terminal can translate to read locally, potent...

CVE-2023-32712 Unauthenticated Log Injection in Splunk Enterprise

In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute ANSI escape codes into Splunk log files that, when a vulnerable terminal application reads them, can potentially, at worst, result in possible code execution in the...

Splunk Enterprise 8.1.0 < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0606)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0606 advisory. - In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards...

PT-2023-7355 · Splunk · Universal Forwarder +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.1.0.2 Splunk Enterprise versions prior to 9.0.5.1 Splunk Enterprise versions prior to 8.2.11.2 Universal Forwarder versions prior to 9.1.0.2 Universal Forwarder versions prior to 9.0.5.1 Universal Forward...

CVE-2023-32712: Improper Output Neutralization for Logs

In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute ANSI escape codes into Splunk log files that, when a vulnerable terminal application reads them, can potentially, at worst, result in possible code execution in the...

SUSE CVE-2018-5205

When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string...

nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes

A regular expression denial of service ReDoS vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes...

nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes

A regular expression denial of service ReDoS vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes...

nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes

A regular expression denial of service ReDoS vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes...

nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes

A regular expression denial of service ReDoS vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes...

Security update for nodejs8 (important)

openSUSE Security Update: Security update for nodejs8 Announcement ID: openSUSE-SU-22022:20000-2 Rating: important References: 1038980 1191962 1191963 1192153 1192154 1192696 Cross-References: CVE-2017-8923 CVE-2021-23343 CVE-2021-32803 CVE-2021-32804 CVE-2021-3807 CVE-2021-3918 CVSS scores:...

RHEL 8 : nodejs:14 (RHSA-2022:0350)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0350 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...