Splunk Splunk Cloud Platform

• CVE-2024-45736 Medium 6.5 Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon 0.5%
• CVE-2024-45741 Medium 5.4 Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise 14.8%
• CVE-2024-45740 Medium 5.4 Persistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk Enterprise 0.4%
• CVE-2024-36997 Medium 4.6 Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint 0.5%
• CVE-2024-36993 Medium 5.4 Persistent Cross-site Scripting (XSS) in Web Bulletin 0.4%
• CVE-2024-36995 Medium 4.3 Low-privileged user could create experimental items 0.2%
• CVE-2024-36982 High 7.5 Denial of Service through null pointer reference in “cluster/config” REST endpoint 0.5%
• CVE-2024-36990 Medium 6.5 Denial of Service (DoS) on the datamodel/web REST endpoint 0.7%
• CVE-2024-36992 Medium 5.4 Persistent Cross-site Scripting (XSS) in Dashboard Elements 0.3%
• CVE-2024-36986 Medium 6.3 Risky command safeguards bypass through Search ID query in Analytics Workspace 0.4%
• CVE-2024-36983 High 8.0 Command Injection using External Lookups 1.0%
• CVE-2024-36996 Medium 5.3 Information Disclosure of user names 0.4%
• CVE-2024-36994 Medium 5.4 Persistent Cross-site Scripting (XSS) in Dashboard Elements 0.3%
• CVE-2024-36989 Medium 6.5 Low-privileged user could create notifications in Splunk Web Bulletin Messages 0.3%
• CVE-2024-36987 Medium 4.3 Insecure File Upload in the indexing/preview REST endpoint 0.3%
• CVE-2024-29946 High 8.1 Risky command safeguards bypass in Dashboard Examples Hub 0.8%
• CVE-2023-32709 Medium 4.3 Low-privileged User can View Hashed Default Splunk Password 0.4%
• CVE-2023-32707 High 8.8 ‘edit_user’ Capability Privilege Escalation 78.7%
• CVE-2023-32716 Medium 6.5 Denial of Service via the 'dump' SPL command 0.6%
• CVE-2023-32710 Medium 4.8 Information Disclosure via the ‘copyresults’ SPL Command 0.4%
• CVE-2023-32717 Medium 4.3 Role-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search Results 0.4%
• CVE-2023-32706 High 7.7 Denial Of Service due to Untrusted XML Tag in XML Parser within SAML Authentication 0.6%
• CVE-2023-32708 High 7.2 HTTP Response Splitting via the ‘rest’ SPL Command 0.7%
• CVE-2023-22939 High 8.1 SPL Command Safeguards Bypass via the ‘map’ SPL Command in Splunk Enterprise 0.6%
• CVE-2023-22938 Medium 4.3 Permissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk Enterprise 0.4%
• CVE-2023-22937 Medium 4.3 Unnecessary File Extensions Allowed by Lookup Table Uploads in Splunk Enterprise 0.4%
• CVE-2023-22933 High 8.0 Persistent Cross-Site Scripting through the ‘module’ Tag in a View in Splunk Enterprise 0.8%
• CVE-2023-22932 High 8.0 Persistent Cross-Site Scripting through a Base64-encoded Image in a View in Splunk Enterprise 0.4%
• CVE-2023-22936 Medium 6.3 Authenticated Blind Server Side Request Forgery via the ‘search_listener’ Search Parameter in Splunk Enterprise 0.4%
• CVE-2023-22941 Medium 6.5 Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon 1.0%
• CVE-2023-22931 Medium 4.3 ‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk Enterprise 0.4%
• CVE-2023-22935 High 8.1 SPL Command Safeguards Bypass via the ‘display.page.search.patterns.sensitivity’ Search Parameter in Splunk Enterprise 0.6%
• CVE-2023-22934 High 7.3 SPL Command Safeguards Bypass via the ‘pivot’ SPL Command in Splunk Enterprise 1.1%
• CVE-2023-22940 Medium 6.3 SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise 0.4%
• CVE-2022-37438 Low 2.6 Information disclosure via the dashboard drilldown in Splunk Enterprise 0.5%
• CVE-2022-32152 High 8.1 Splunk Enterprise lacked TLS cert validation for Splunk-to-Splunk communication by default 1.0%