CVE-2024-22164

CVE-2024-22164 affects Splunk Enterprise Security (ES) prior to version 7.1.2. The vulnerability is triggered via the investigation attachments endpoint, where insufficient request size limiting can cause a denial of service (DoS) that makes an Investigation inaccessible. Affected component is th...

CVE-2024-22164 Denial of Service of an Investigation in Splunk Enterprise Security through Investigation attachments

In Splunk Enterprise Security ES versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service DoS to the Investigation. The attachment endpoint does not properly limit the size of the request which lets an attacker cause the Investigation to become inaccessib...

CVE-2024-22165 Denial of Service in Splunk Enterprise Security of the Investigations manager through Investigation creation

In Splunk Enterprise Security ES versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service DoS. The malformed investigation prevents the generation and rendering of the Investigations manager until it is deleted.The vulnerability requires an...

CVE-2024-22165 Denial of Service in Splunk Enterprise Security of the Investigations manager through Investigation creation

In Splunk Enterprise Security ES versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service DoS. The malformed investigation prevents the generation and rendering of the Investigations manager until it is deleted.The vulnerability requires an...

CVE-2024-22165

Affected product: Splunk Enterprise Security (ES)

PT-2024-19253 · Splunk · Splunk Enterprise Security

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise Security ES versions prior to 7.1.2 Description: The issue allows an attacker to create a malformed Investigation, leading to a denial of service DoS that prevents the generation and rendering of the Investigations manager...

Splunk Security Breach

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

PT-2024-19252 · Splunk · Splunk Enterprise Security

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise Security ES versions prior to 7.1.2 Description: The issue allows an attacker to perform a denial of service DoS to the Investigation by using investigation attachments. This is possible because the attachment endpoint does...

Splunk Security Breach

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

Metasploit Weekly Wrap-Up 1/05/2024

New module content 2 Splunk raw Server Info Disclosure Authors: KOF2002, h00die, and n00bhaxor Type: Auxiliary Pull request: 18635 contributed by n00bhaxor Path: gather/splunkrawserverinfo Description: This PR adds a module for an authenticated Splunk information disclosure vulnerability. This...

Metasploit Weekly Wrap-Up: Dec. 15, 2023

Continuing the 12th Labor of Metasploit Metasploit continues its Herculean task of increasing our toolset to tame Kerberos by adding support for ASREP Roasting, which allows retrieving the password hashes of users who have Do not require Kerberos preauthentication set on the domain controller. Th...

Splunk XSLT Upload Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Splunk Authenticated XSLT Upload RCE', 'Description' = %q This Metasploit module exploits a Remote Code Execution RCE vulnerability in Splunk...

Splunk XSLT Upload Remote Code Execution Exploit

This Metasploit module exploits a remote code execution vulnerability in Splunk Enterprise. The affected versions include 9.0.x before 9.0.7 and 9.1.x before 9.1.2. The exploitation process leverages a weakness in the XSLT transformation functionality of Splunk. Successful exploitation requires...

The vulnerability of the Splunk Enterprise platform for operational analysis, related to insufficient checking of exceptional states, allows a violator to trigger a service failure.

The vulnerability of the Splunk Enterprise platform for operational analysis is related to insufficient checking of exceptional states. Exploiting this vulnerability could allow a malicious actor to trigger a service failure using the SPL “dump” command...

The vulnerability of the Splunk App for Lookup File Editing application, which exists due to the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Splunk App for Lookup File Editing application exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out cross-site scripting attacks remotely...

The vulnerability of the web service journal of the Splunk Enterprise platform for operational analysis allows a perpetrator to execute arbitrary code.

The vulnerability of the log service of the Splunk Enterprise platform for operational analysis is related to the improper processing of log output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted HTTP request containing ANSI...

Splunk Authenticated XSLT Upload RCE

This Metasploit module exploits a Remote Code Execution RCE vulnerability in Splunk Enterprise. The affected versions include 9.0.x before 9.0.7 and 9.1.x before 9.1.2. The exploitation process leverages a weakness in the XSLT transformation functionality of Splunk. Successful exploitation requir...

VulnCheck KEV: CVE-2018-11409

Splunk through 7.0.1 allows information disclosure by appending raw/services/server/info/server-info?outputmode=json to a query, as demonstrated by discovering a license key...

Vulnerability fixed in Splunk

A vulnerability has been fixed in Splunk. A malicious person with prior authentication and rights to upload XSLT files, could exploit the vulnerability to execute arbitrary code via the upload of an XSLT file to execute arbitrary code with permissions from the application. Because it is not...

The vulnerability of the “Show Syntax Highlighted” function on the Splunk Enterprise operating system for Windows allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the “Show Syntax Highlighted” function on the Splunk Enterprise operating system for Windows exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out cross-site scripting attacks remotely...