CVE-2024-53244

CVE-2024-53244 affects Splunk Enterprise and Splunk Cloud Platform: versions prior to 9.3.2 (Enterprise) and prior to 9.2.2406.107, 9.2.2403.109, 9.1.2312.206 (Cloud) are vulnerable. The issue is a bypass of SPL safeguards for risky commands via the s parameter on the /en-US/app/search/report end...

CVE-2024-53246 Sensitive Information Disclosure through SPL commands

In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.111, and 9.1.2312.206, an SPL command can potentially disclose sensitive information. The vulnerability requires the exploitation of another vulnerability, suc...

CVE-2024-53246 Sensitive Information Disclosure through SPL commands

In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.111, and 9.1.2312.206, an SPL command can potentially disclose sensitive information. The vulnerability requires the exploitation of another vulnerability, suc...

CVE-2024-53246: Cleartext Transmission of Sensitive Information

In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.111, and 9.1.2312.206, an SPL command can potentially disclose sensitive information. The vulnerability requires the exploitation of another vulnerability, suc...

MAL-2024-10167 Malicious code in spl-token (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in spl-token (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in spl-types (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 62ae4c4e03f2865a43a463427c66b7131a5c981b645d24d246d93435347e5819 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: spl-types-rentry-2024-07 Reasons based on the campaign: -...

MAL-2024-12336 Malicious code in raydium (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 236ebe472d3c676e9d99d6370d989ade43f7acdec0a2076c3dedbc9682b8f3a2 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: spl-types-rentry-2024-07 Reasons based on the campaign: -...

MAL-2024-12337 Malicious code in raydium-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e485f39cf4f7255533241d5feba7f3d2bb7b80f37adde2d0a2046c838bfd4fef --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: spl-types-rentry-2024-07 Reasons based on the campaign: -...

Malicious code in raydium-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e485f39cf4f7255533241d5feba7f3d2bb7b80f37adde2d0a2046c838bfd4fef --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: spl-types-rentry-2024-07 Reasons based on the campaign: -...

MAL-2024-12347 Malicious code in sol-instruct (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1476f5fb9d2cca155c1adb783b39f5fce22901480eb717733ed7e687bfd978f2 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: spl-types-rentry-2024-07 Reasons based on the campaign: -...

Malicious code in sol-instruct (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1476f5fb9d2cca155c1adb783b39f5fce22901480eb717733ed7e687bfd978f2 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: spl-types-rentry-2024-07 Reasons based on the campaign: -...

MAL-2024-12349 Malicious code in spl-types (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 62ae4c4e03f2865a43a463427c66b7131a5c981b645d24d246d93435347e5819 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: spl-types-rentry-2024-07 Reasons based on the campaign: -...

CVE-2024-36986

Summary of CVE-2024-36986 (Splunk) : An authenticated Splunk user can bypass SPL safeguards for risky commands in Analytics Workspace by abusing a Search ID query flow. Impact is that a low-privilege, phishing-recruited user can execute commands with higher-privilege permissions, potentially lead...

CVE-2024-36986: Exposure of Sensitive Information to an Unauthorized Actor

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safeguards for risky commands in the Analytics...

CVE-2024-29946

In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phish the victim by tricking them into...

CVE-2024-29946 Risky command safeguards bypass in Dashboard Examples Hub

In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phish the victim by tricking them into...

CVE-2024-29946

CVE-2024-29946 affects Splunk Enterprise versions older than 9.2.1, 9.1.4, and 9.0.9. The Dashboard Examples Hub lacks protections for risky SPL commands, potentially allowing bypass of safeguards. The attack requires phishing the victim into initiating a browser request. Remediation per connecte...

CVE-2024-29946: Improper Input Validation

In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phish the victim by tricking them into...

Splunk Enterprise 9.0.0 < 9.0.9, 9.1.0 < 9.1.4, 9.2.0 < 9.2.1 (SVD-2024-0302)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-0302 advisory. - In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL...