CVE-2022-32154

Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and...

CVE-2022-32157

Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients...

CVE-2022-32156

In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface CLI did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation for the Splunk CLI...

PT-2022-3396

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.0 Description The issue is related to the lack of an authentication procedure in Splunk Enterprise deployment servers, allowing unauthenticated downloading of forwarder bundles. This can potentially enable...

PT-2022-21125

Name of the Vulnerable Software and Affected Versions Splunk Enterprise and Universal Forwarder versions prior to 9.0 Description The issue is related to the Splunk command-line interface CLI not validating TLS certificates while connecting to a remote Splunk platform instance by default. This...

CVE-2022-32156: Improper Certificate Validation

In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface CLI did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation for the Splunk CLI...

CVE-2022-32156 Splunk Enterprise and Universal Forwarder CLI connections lacked TLS cert validation

In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface CLI did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation for the Splunk CLI...

CVE-2022-32156

CVE-2022-32156 affects Splunk Enterprise and Universal Forwarder prior to 9.0, where the CLI did not validate TLS certificates when connecting to a remote Splunk platform. The issue’s root cause is missing TLS host-name validation by default, potentially enabling misconfigured nodes to bypass val...

Splunk Enterprise 8.1.x < 8.1.6 MFA Bypass

According to its self-reported version number, the version of Splunk running on the remote web server is Splunk Enterprise 8.1.x prior to 8.1.6. It is, therefore, affected by a vulnerability in Splunk Enterprise's implementation of DUO MFA that allows for bypassing the MFA verification. The...

Splunk Enterprise 8.1 < 8.1.4 XSS

According to its self-reported version number, the version of Splunk running on the remote web server is Splunk Enterprise 8.1.x prior to 8.1.4 It may, therefore, be affected by a reflected XSS vulnerability. The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in ...

All Vulnerabilities for issm.rj.gov.br Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| issm.rj.gov.br ---|--- Open Bug Bounty...

Jenkins Splunk Plugin Sandbox Bypass

Jenkins Splunk Plugin has a form validation HTTP endpoint used to validate a user-submitted Groovy script through compilation, which was not subject to sandbox protection. This allowed attackers with Overall/Read access to execute arbitrary code on the Jenkins controller by applying AST...

GHSA-CJR8-5RW4-WH65 Jenkins Splunk Plugin Sandbox Bypass

Jenkins Splunk Plugin has a form validation HTTP endpoint used to validate a user-submitted Groovy script through compilation, which was not subject to sandbox protection. This allowed attackers with Overall/Read access to execute arbitrary code on the Jenkins controller by applying AST...

All Vulnerabilities for site.ajes.edu.br Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| site.ajes.edu.br ---|--- Open Bug Bount...

com.splunk.splunkins:splunk-devops-extend (>=1.0, <=1.7.0), org.jenkins-ci.plugins.pipeline-stage-view:pipeline-rest-api (>=1.8-beta-1, <=2.11) +2 more potentially affected by CVE-2022-30945 via org.jenkins-ci.plugins.workflow:workflow-cps (2.2)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - com.splunk.splunkins:splunk-devops-extend =1.0, =1.8-beta-1, =1.8-beta-1,...

Salt vulnerable to Improper Certificate Validation

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules...

How Imperva Data Security Fabric Reduces Splunk Ingestion Costs and Accelerates Incident Management

They say the devil is in the details. This is especially true for security professionals that use Splunk as their organization’s primary security analytics engine. Splunk analytics gives security teams a real-time view of machine data from networks, data centers, or IT environments. Organizations...

CVE-2022-27183

The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, and not installed on Splunk Cloud Platfo...

CVE-2021-42743

A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions before 8.1.1 on Windows...

CVE-2022-26889

In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page e.g., HTML Injection, XSS or bypass SPL safeguards for risky commands. The attack...