Splunk Enterprise Views Dashboard Phishing

The vulnerability of the Views Dashboard component of the Splunk Enterprise operational analytics platform is related to the redirection of the URL to an unreliable website. Exploiting this vulnerability allows a malicious actor to conduct phishing attacks using a specially created URL address...

Splunk Enterprise SSRF

The vulnerability of the Splunk Enterprise platform for operational analysis is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack by sending a specially crafted HTTP request remotely...

Splunk Enterprise Permission Access

The vulnerability of the Splunk Enterprise platform for operational analysis is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow a malicious actor to gain access to the installation directory by default, C:\Program Files\Splunk and...

Splunk MCP Server Auth Bypass

The vulnerability of the Splunk MCP Server data processing and analysis application is related to authentication errors. Exploiting this vulnerability allows a malicious actor to bypass the restrictions on allowed commands in the MCP Model Context Protocol...

Splunk Enterprise Unauthorized Access

The vulnerability of the Splunk Enterprise platform for operational analysis is related to insufficient protection of operational data. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Splunk Enterprise DoS

The vulnerability of the Splunk Enterprise platform for operational analysis is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

Splunk Universal Forwarder Permission Access

The vulnerability of the monitoring and data collection application for various sources is related to the improper assignment of permissions to the critical resource. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the installation directory by...

Splunk Enterprise Data Poisoning

The vulnerability of the Splunk Enterprise platform for operational analysis is related to the improper processing of output data for registration logs. Exploiting this vulnerability allows a malicious actor to poison, falsify, or hide confidential data from log records using specially created HT...

Splunk Enterprise XSS

The vulnerability of the Splunk Enterprise platform for operational analysis is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

Splunk Web DoS

The vulnerability in the Splunk Web platform for operational analysis in Splunk Enterprise relates to an uncontrolled resource consumption when processing the changeauthentication parameter. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Splunk Enterprise Unauthorized Access

The vulnerability of the Splunk Enterprise platform for operational analysis is related to insufficient protection of operational data. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...

Splunk Enterprise REST API SSRF

The vulnerability of the REST API component of the Splunk Enterprise platform for operational analysis is related to insufficient validation of requests at the server side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...

Splunk Web Arbitrary JavaScript Execution

The vulnerability in the Splunk Web interface of the Splunk Enterprise operating analysis platform is related to the failure to protect the structure of the web page when processing the dataset.command parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScri...

Logendpoint Component Redirection

The vulnerability of the Logendpoint component of the Splunk Enterprise platform for operational analysis is related to the redirection of the URL to an unreliable website. Exploiting this vulnerability could allow a malicious actor to redirect users to any given URL address...

CVE-2025-20381

In Splunk MCP Server app versions below 0.2.4, a user with access to the "runsplunkquery" Model Context Protocol MCP tool could bypass the SPL command allowlist controls in MCP by embedding SPL commands as sub-searches, leading to unauthorized actions beyond the intended MCP restrictions...

com.lookout.jenkins:environment-script (>=1.2.4, <=1.2.6), com.mig82:folder-properties (>=1.0, <=1.2.1) +25 more potentially affected by CVE-2025-67639 via org.jenkins-ci.main:jenkins-core (1.642.4)

org.jenkins-ci.main:jenkins-core MAVEN version 1.642.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.lookout.jenkins:environment-script =1.2.4, =1.0, =1.0.3, =1.0, =1.0, =1.0, =1.4, =1.4,...

Vulnerabilities fixed in Splunk Enterprise and Splunk Cloud Platform

Splunk has fixed vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. The vulnerabilities include several issues, including the ability for low-privileged users to create unauthorized dashboards, access sensitive information via mobile notifications, and the injection of ANSI escape...

Exploit for Improper Output Neutralization for Logs in Splunk

SPLUNK CVE-2025-20384 i dunno, i just read stuff my friendo s...

CVE-2025-20385

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117, a user who holds a role with a high privilege capability adminallobjects could craft a malicious payload through the href attribute of an anch...

CVE-2025-20389

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and versions below 3.9.10, 3.8.58 and 3.7.28 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the...