CVE-2024-36991-Tool

CVE-2024-36991-Herramienta Este POC binario automatiza la explotación de CVE-2024-36991 mediante el envío de solicitudes curl diseñadas a una instancia vulnerable de Splunk. Recupera archivos sensibles y los guarda localmente para su posterior análisis. El script es modular, permitiendo a los...

CVE-2024-36991

Plantilla de Nuclei para CVE-2024-36991 Descripción Este repositorio contiene una plantilla de Nuclei para detectar la vulnerabilidad de path traversal en Splunk Enterprise en versiones de Windows inferiores a 9.2.2, 9.1.5 y 9.0.10. La vulnerabilidad permite el acceso no autorizado a archivos...

CVE-2026-20253-Splunk-Enterprise-Pre-Auth-RCE-

CVE-2026-20253 - Splunk Enterprise Pre-Auth RCE PoC CVE-2026-20253 - Splunk Enterprise Pre-Auth RCE PoC ⚠️ ADVERTENCIA : Este script es solo para fines educativos y de prueba en entornos autorizados. El uso no autorizado está prohibido y puede ser ilegal. 📋 Descripción Este repositorio contiene un...

crowdstrike-falcon-queries

crowdstrike-falcon-queries A collection of Splunk's Search Processing Language SPL for Threat Hunting with CrowdStrike Falcon Developed and maintained by Intelligent Response team, i-secure co., Ltd. crowdstrike-falcon-queries Execution of Renamed Executables List of Living Off The Land Binaries...

sysmon-modular

sysmon-modular | A Sysmon configuration repository for everybody to customise Sysmon Modular is a configuration repository for Microsoft Sysinternals Sysmon. Small XML modules make it easier to select, review and maintain the telemetry that is useful to your organisation. The sysmon-modular Go to...

Splunk-RCE-poc

Splunk RCE - PoC Proof of concept exploit for CVE-2023-46214, SVD-2023-1104 Usage The Splunk instance URL, username, password, reverse shell IP, and port are all required as command-line parameters. For example: $ python3 CVE-2023-46214.py --url --username --password --ip --port Prerequisites...

struts-splunk

struts-splunk Vuln Apache Struts with splunk...

rip_raw

Rip Raw Rip Raw is a small tool to analyse the memory of compromised Linux systems. It is similar in purpose to Bulk Extractor, but particularly focused on extracting system Logs from memory dumps from Linux systems. This enables you to analyse systems without needing to generate a profile. This ...

CVE-2026-20253

CVE-2026-20253 Lab Environment Splunk Enterprise Pre-Auth RCE via PostgreSQL Sidecar Service | ---|--- CVE| CVE-2026-20253 CVSS| 9.8 Critical Type| Unauthenticated Remote Code Execution CWE| CWE-306: Missing Authentication for Critical Function Product| Splunk Enterprise 10.0.x / 10.2.x DISCLAIME...

Splunk <=7.0.1 - Information Disclosure

Splunk through 7.0.1 is susceptible to information disclosure by appending raw/services/server/info/server-info?outputmode=json to a query, as demonstrated by discovering a license key. id: CVE-2018-11409 info: name: Splunk =7.0.1 - Information Disclosure author: harshbothra severity: medium...

Astra Linux – Vulnerability in Ansible

Ansible versions 2.9.x before 2.9.1, 2.8.x before 2.8.7, and 2.7.x before 2.7.15 do not respect the “nolog” flag set to True when using Sumologic and Splunk callback plugins to send task result events to collectors. This could lead to the disclosure and collection of sensitive data...

Exploit for Missing Authentication for Critical Function in Splunk

CVE-2026-20253 Lab Environment Splunk Enterprise Pre-Auth R...

HTSOC

HTSOC — Integrated SOC System for Event Monitoring, Detection, and Investigation HTSOC is a self-built Security Operations Center system in a lab environment. The system combines log collection, detection with Splunk, alert/case management with TheHive, Observable analysis with Cortex, IOC lookup...

detection-defense-library — Updated!

Detection Defense Library One defense-engineering library, consolidated. Attack classes, the patterns that detect them, the committed Sigma rules, and the Windows trust-boundary model, all in a single repo. This repo folds in five former sibling repositories: Former repo| Folded into| What it hol...

Splunk Enterprise’s vulnerabilities are exploited through Splunk

Splunk has identified several vulnerabilities in Splunk Enterprise, particularly in versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. These vulnerabilities include: - Inadequate enforcement of authentication and authorization checks in REST APIs, allowing unauthorized users to access sensitiv...

CVE-2026-76355

creationtimestamp| type| source ---|---|--- 2026-08-20 04:47:20+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76354

creationtimestamp| type| source ---|---|--- 2026-08-20 04:47:18+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-24 17:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtts42qkba2u...

CVE-2026-76353

creationtimestamp| type| source ---|---|--- 2026-08-20 04:47:16+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76352

creationtimestamp| type| source ---|---|--- 2026-08-20 04:47:14+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-22 18:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtow75jsbr24...

CVE-2026-76351

creationtimestamp| type| source ---|---|--- 2026-08-20 04:47:11+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 00:00:08+00:00| published-proof-of-concept| Telegram/87w5sTCGBPeMw8h3c2UBbBkEJEqeSW1iUUAENsR3qsz5w 2026-08-22...