CVE-2022-38691_38692

CVE-2022-38691/38692 avviare persistentemente FDL1/SPL senza firma NOTA: rimuovere prima il controllo della firma delle immagini Boot Chain in FDL1/SPL ​ fdl1 usa genfdl1-dl sourcecode ​ spl android 9/10, usa genspl-unlock-legacy sourcecode ​ spl android 11+, usa genspl-unlock sourcecode ​...

Detection-Rules

APT29-Erkennungsregeln Detection Engineering Produktionsreife Sigma-Erkennungsregeln, entwickelt aus der Analyse von 196.071 Sysmon-Ereignissen im APT29-Datensatz der MITRE ATT&CK Evaluations. Überblick Dieses Repository enthält validierte Erkennungsregeln für Angreiferverhalten, das während der...

patch-CVE-2026-28001

Correção: CVE-2026-28001 Detalhes da Vulnerabilidade CVE : CVE-2026-28001 Produto : Splunk Enterprise Descrição : Execução remota de código na análise de SPL Severidade : Crítica Status da Correção: IMPLANTADO...

crowdstrike-falcon-queries

crowdstrike-falcon-queries Una raccolta di Search Processing Language SPL di Splunk per la Threat Hunting con CrowdStrike Falcon Sviluppato e mantenuto dal team Intelligent Response di i-secure co., Ltd. crowdstrike-falcon-queries Esecuzione di eseguibili rinominati Elenco dei binari Living Off T...

EUVD-2026-62952

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...

EUVD-2026-62906

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language SPL in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the SPL when that user...

EUVD-2026-62914

In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language SPL commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access...

EUVD-2026-62904

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject arbitrary Search Processing Language SPL commands through the geostats command. The injected SPL runs with the permissions of another authenticated use...

EUVD-2026-62907

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language SPL commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user...

EUVD-2026-62896

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language SPL into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system...

EUVD-2026-62893

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language SPL in a dashboard. When another authenticated user exports the dashboard as a Portable Document Format PDF file, Splunk...

EUVD-2026-62899

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action containing attacker-controlled Search Processing Language SPL. When another authenticated user selects the action from Event Actions and...

EUVD-2026-62894

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role into opening a crafted link to Monitoring Console. When that user opens the link, Splunk Enterprise runs attacker-controlled Search Processing...

EUVD-2026-62897

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language S...

EUVD-2026-63129

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language SPL for another authenticated user. The attacker-controlled SPL could access all releva...

EUVD-2026-63134

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, an unauthenticated user could trick a user who holds the "admin" or "scadmin" Splunk roles into opening a crafted Splunk Web Uniform Resource Locator URL. T...

EUVD-2026-63130

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could bypass Search Processing Language SPL safeguards for risky commands through the Job Details dashboard. The injected SPL could run using the permissions of an...

EUVD-2026-63128

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language SPL into requests that search for events near a selected event. This could allow for unauthorized search execution. The vulnerability is possible becau...

EUVD-2026-63127

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could cause an authenticated user to run arbitrary Search Processing Language SPL searches on their behalf through the Event Type Builder. This could expose all relevant data and stored credentials. Th...

EUVD-2026-63123

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language SPL pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all...