CVE-2011-4778

Cross-site scripting XSS vulnerability in Splunk Web in Splunk 4.2.x before 4.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPL-44614...

Cross site request forgery (csrf)

mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote authenticated administrators to execute arbitrary code by leveraging the sys module in a request to the search application, as demonstrated by a...

Cross site scripting

Cross-site scripting XSS vulnerability in Splunk Web in Splunk 4.2.x before 4.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPL-44614...

CVE-2011-4778

Cross-site scripting XSS vulnerability in Splunk Web in Splunk 4.2.x before 4.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPL-44614...

CVE-2011-4642

Splunk Web in Splunk 4.2.x before 4.2.5 is vulnerable in the mappy command, which can allow remote authenticated administrators to execute arbitrary code by abusing the sys module in a request to the search application (CSRF scenario). The issue is triggered through the mappy usage in Splunk Web,...

CVE-2011-4778

CVE-2011-4778 affects Splunk Web in Splunk 4.2.x up to, but not including, 4.2.5. It is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors (aka SPL-44614). Impact is remote code execution of scripts within the bro...

CVE-2011-4643

CVE-2011-4643 affects Splunk 4.x prior to 4.2.5. Multiple directory traversal vulnerabilities allow remote authenticated users to read arbitrary files via a .. in a URI to either Splunk Web or the Splunkd HTTP Server (SPL-45243). Root cause is improper handling of dot-dot path components in the w...

CVE-2011-4643

Multiple directory traversal vulnerabilities in Splunk 4.x before 4.2.5 allow remote authenticated users to read arbitrary files via a .. dot dot in a URI to 1 Splunk Web or 2 the Splunkd HTTP Server, aka SPL-45243...

CVE-2011-4642: Cross-Site Request Forgery (CSRF)

mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote authenticated administrators to execute arbitrary code by leveraging the sys module in a request to the search application, as demonstrated by a...

PT-2012-1937

Name of the Vulnerable Software and Affected Versions Splunk versions 4.0 through 4.2.5 Description The issue allows remote authenticated users to read arbitrary files via a .. dot dot in a URI to 1 Splunk Web or 2 the Splunkd HTTP Server. Recommendations For versions 4.0 through 4.2.5, update to...

CVE-2011-4778: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Splunk Web in Splunk 4.2.x before 4.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPL-44614...

CVE-2011-4643: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in Splunk 4.x before 4.2.5 allow remote authenticated users to read arbitrary files via a .. dot dot in a URI to 1 Splunk Web or 2 the Splunkd HTTP Server, aka SPL-45243...