Splunk Enterprise and Splunk Light Web Cross-Site Scripting Vulnerabilities

Splunk is a suite of data collection and analysis software. The software is primarily used to collect, index and analyze machine-generated data, including data generated by all IT systems and infrastructure. A cross-site scripting vulnerability exists in Splunk Enterprise and Splunk Light in the...

CVE-2015-6514

Cross-site scripting XSS vulnerability in the Dashboard in Splunk Enterprise 6.2.x before 6.2.4 and Splunk Light 6.2.x before 6.2.4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.4, 6.1.x before 6.1.8, 6.0.x before 6.0.9, and 5.0.x before 5.0.13 and Splunk Light 6.2.x before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via a header...

CVE-2015-6514

Cross-site scripting XSS vulnerability in the Dashboard in Splunk Enterprise 6.2.x before 6.2.4 and Splunk Light 6.2.x before 6.2.4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-6515

CVE-2015-6515 involves an XSS flaw in Splunk Web for Splunk Enterprise (versions 6.2.x before 6.2.4, 6.1.x before 6.1.8, 6.0.x before 6.0.9, 5.0.x before 5.0.13) and Splunk Light 6.2.x before 6.2.4. The vulnerability allows remote attackers to inject arbitrary web script or HTML via an HTTP heade...

PT-2015-7279

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 5.0.x through 5.0.12, 6.0.x through 6.0.8, 6.1.x through 6.1.7, 6.2.x through 6.2.3 Splunk Light versions 6.2.x through 6.2.3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary w...

PT-2015-7278

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 6.2.x through 6.2.3 Splunk Light versions 6.2.x through 6.2.3 Description A cross-site scripting XSS issue exists in the Dashboard of Splunk Enterprise and Splunk Light, allowing remote authenticated users to inject...

CVE-2015-6514: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Dashboard in Splunk Enterprise 6.2.x before 6.2.4 and Splunk Light 6.2.x before 6.2.4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-6515: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.4, 6.1.x before 6.1.8, 6.0.x before 6.0.9, and 5.0.x before 5.0.13 and Splunk Light 6.2.x before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via a header...

Splunk Enterprise and Splunk Light Input Validation Cross-Site Scripting Vulnerability

Splunk is the engine of machine data. Splunk collects, indexes, and utilizes fast-moving computer data generated by all applications, servers, and devices. Splunk suffers from a cross-site scripting vulnerability that could be exploited by a remote attacker to inject malicious script or HTML code...

Splunk Enterprise 5.0.x < 5.0.13 / 6.0.x < 6.0.9 / 6.1.x < 6.1.8 OpenSSL Vulnerabilities (FREAK)

According to its version number, the Splunk Enterprise hosted on the remote web server is 5.0.x prior to 5.0.13, 6.0.x prior to 6.0.9, or 6.1.x prior to 6.1.4. It is, therefore, affected by the following vulnerabilities related to the included OpenSSL library : - A security feature bypass...

Splunk Enterprise 6.2.x < 6.2.2 Multiple Vulnerabilities (FREAK)

According to its version number, the Splunk Enterprise hosted on the remote web server is version 6.2.x prior to 6.2.2. It is, therefore, affected by the following vulnerabilities : - A flaw exists with ECDH handshakes when using an ECDSA certificate without a ServerKeyExchange message. This allo...

CVE-2014-5466

Cross-site scripting XSS vulnerability in the Dashboard in Splunk Web in Splunk Enterprise 6.1.x before 6.1.4, 6.0.x before 6.0.7, and 5.0.x before 5.0.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Dashboard in Splunk Web in Splunk Enterprise 6.1.x before 6.1.4, 6.0.x before 6.0.7, and 5.0.x before 5.0.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-5466

The CVE-2014-5466 issue concerns Splunk Enterprise’s Dashboard in Splunk Web (Splunk Enterprise 6.1.x before 6.1.4, 6.0.x before 6.0.7, and 5.0.x before 5.0.10). The root cause is an XSS flaw in the Dashboard caused by improper input validation in the web interface. This enables remote attackers ...

CVE-2014-5466

Cross-site scripting XSS vulnerability in the Dashboard in Splunk Web in Splunk Enterprise 6.1.x before 6.1.4, 6.0.x before 6.0.7, and 5.0.x before 5.0.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-5466: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Dashboard in Splunk Web in Splunk Enterprise 6.1.x before 6.1.4, 6.0.x before 6.0.7, and 5.0.x before 5.0.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2014-6494

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 5.0.x through 5.0.9 Splunk Enterprise versions 6.0.x through 6.0.6 Splunk Enterprise versions 6.1.x through 6.1.3 Description A cross-site scripting XSS issue exists in the Dashboard of Splunk Web, allowing remote...

Splunk Enterprise 5.0.x < 5.0.11 Multiple Vulnerabilities (POODLE)

According to its version number, the Splunk Enterprise hosted on the remote web server is 5.0.x prior to 5.0.11. It is, therefore, affected by the following vulnerabilities : - A man-in-the-middle MitM information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0 handles...

Splunk Enterprise 5.0.x < 5.0.10 / 6.1.x < 6.1.4 Multiple Vulnerabilities

According to its version number, the Splunk Enterprise hosted on the remote web server is 5.0.x prior to 5.0.10 or 6.1.x prior to 6.1.4. It is, therefore, affected by the following vulnerabilities : - The included OpenSSL library contains a TLS downgrade weakness. By using fragmented ClientHello...