Skip to contentSplunk Cloud Platform vulnerabilities
- splunk, splunk cloud platform, enterprise +2 moreImproperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk DaemonCVE-2024-457366.5 Medium
- splunk, splunk cloud platform, enterprise +2 morePersistent Cross-Site Scripting (XSS) via props.conf on Splunk EnterpriseCVE-2024-45741EPSS 14.8%5.4 Medium
- splunk, splunk cloud platform, enterprise +2 morePersistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk EnterpriseCVE-2024-457405.4 Medium
- splunk, splunk cloud platform, enterprise +2 morePersistent Cross-site Scripting (XSS) in conf-web/settings REST endpointCVE-2024-369974.6 Medium
- splunk, splunk cloud platform, enterprise +2 morePersistent Cross-site Scripting (XSS) in Web BulletinCVE-2024-369935.4 Medium
- splunk, splunk cloud platform, enterprise +2 moreLow-privileged user could create experimental itemsCVE-2024-369954.3 Medium
- splunk cloud, splunk, splunk cloud platform +1 more +3 moreDenial of Service through null pointer reference in “cluster/config” REST endpointCVE-2024-369827.5 High
- splunk, splunk cloud platform, enterprise +2 moreDenial of Service (DoS) on the datamodel/web REST endpointCVE-2024-369906.5 Medium
- splunk, splunk cloud platform, enterprise +2 morePersistent Cross-site Scripting (XSS) in Dashboard ElementsCVE-2024-369925.4 Medium
- splunk cloud, splunk, splunk cloud platform +1 more +3 moreRisky command safeguards bypass through Search ID query in Analytics WorkspaceCVE-2024-369866.3 Medium
- splunk, splunk cloud platform, enterprise +2 moreInformation Disclosure of user namesCVE-2024-369965.3 Medium
- splunk, splunk cloud platform, enterprise +2 moreCommand Injection using External LookupsCVE-2024-369838.0 High
- splunk, splunk cloud platform, enterprise +2 morePersistent Cross-site Scripting (XSS) in Dashboard ElementsCVE-2024-369945.4 Medium
- splunk cloud, splunk, splunk cloud platform +1 more +3 moreLow-privileged user could create notifications in Splunk Web Bulletin MessagesCVE-2024-369896.5 Medium
- splunk cloud, splunk, splunk cloud platform +1 more +3 moreInsecure File Upload in the indexing/preview REST endpointCVE-2024-369874.3 Medium
- splunk, splunk enterprise, cloud +1 more +3 moreRisky command safeguards bypass in Dashboard Examples HubCVE-2024-299468.1 High
- splunk, splunk cloud platform, enterprise +2 moreLow-privileged User can View Hashed Default Splunk PasswordCVE-2023-327094.3 Medium
- splunk, splunk cloud platform, enterprise +2 more‘edit_user’ Capability Privilege EscalationCVE-2023-32707Public exploitEPSS 78.7%8.8 High
- splunk, splunk cloud platform, enterprise +2 moreDenial of Service via the 'dump' SPL commandCVE-2023-327166.5 Medium
- splunk, splunk cloud platform, enterprise +2 moreRole-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search ResultsCVE-2023-327174.3 Medium
- splunk, splunk cloud platform, enterprise +2 moreInformation Disclosure via the ‘copyresults’ SPL CommandCVE-2023-327104.8 Medium
- splunk, splunk enterprise, cloud platform +2 moreDenial Of Service due to Untrusted XML Tag in XML Parser within SAML AuthenticationCVE-2023-327067.7 High
- splunk, splunk cloud platform, enterprise +2 moreHTTP Response Splitting via the ‘rest’ SPL CommandCVE-2023-327087.2 High
- splunk, splunk enterprise, cloud platform +2 moreSPL Command Safeguards Bypass via the ‘map’ SPL Command in Splunk EnterpriseCVE-2023-229398.1 High
- splunk, splunk enterprise, cloud platform +2 morePermissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk EnterpriseCVE-2023-229384.3 Medium
- splunk, splunk enterprise, cloud platform +2 moreUnnecessary File Extensions Allowed by Lookup Table Uploads in Splunk EnterpriseCVE-2023-229374.3 Medium
- splunk, splunk enterprise, cloud platform +2 morePersistent Cross-Site Scripting through the ‘module’ Tag in a View in Splunk EnterpriseCVE-2023-229338.0 High
- splunk, splunk enterprise, cloud platform +2 moreAuthenticated Blind Server Side Request Forgery via the ‘search_listener’ Search Parameter in Splunk EnterpriseCVE-2023-229366.3 Medium
- splunk, splunk enterprise, cloud platform +2 morePersistent Cross-Site Scripting through a Base64-encoded Image in a View in Splunk EnterpriseCVE-2023-229328.0 High
- splunk, splunk enterprise, cloud platform +2 moreImproperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk DaemonCVE-2023-22941Public exploit6.5 Medium
- splunk, splunk enterprise, cloud platform +2 moreSPL Command Safeguards Bypass via the ‘display.page.search.patterns.sensitivity’ Search Parameter in Splunk EnterpriseCVE-2023-229358.1 High
- splunk, splunk enterprise, cloud platform +2 more‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk EnterpriseCVE-2023-229314.3 Medium
- splunk, splunk enterprise, cloud platform +2 moreSPL Command Safeguards Bypass via the ‘pivot’ SPL Command in Splunk EnterpriseCVE-2023-229347.3 High
- splunk, splunk enterprise, cloud platform +2 moreSPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk EnterpriseCVE-2023-229406.3 Medium
- splunk, splunk enterprise, cloud platform +2 moreInformation disclosure via the dashboard drilldown in Splunk EnterpriseCVE-2022-374382.6 Low
- splunk, splunk enterprise, splunk, inc splunk enterprise +2 more +4 moreRisky commands warnings in Splunk Enterprise DashboardsCVE-2022-321546.8 Medium
- splunk, splunk cloud platform, enterprise +2 more +4 moreSplunk Enterprise lacked TLS host name validationCVE-2022-321538.1 High
- splunk, splunk cloud platform, enterprise +2 moreSplunk Enterprise lacked TLS cert validation for Splunk-to-Splunk communication by defaultCVE-2022-321528.1 High
- splunk, splunk cloud platform, enterprise +2 more +4 moreSplunk Enterprise disabled TLS validation using the CA certificate stores in Python 3 libraries by defaultCVE-2022-321517.4 High