https://vulnogram.org/ Most recent CVEs assigned by splunk (splunk). https://vulnogram.org/seaview/icons/splunk.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2025-0367 https://vulnogram.org/CVE-2025-0367 In versions 3.1.0 and lower of the Splunk Supporting Add-on for Active Directory, also known as SA-ldapsearch, a vulnerable regular expression pattern could lead to a Regular Expression Denial of Service (ReDoS) attack. Medium Thu, 30 Jan 2025 17:04:49 GMT https://vulnogram.org/CVE-2025-22621 https://vulnogram.org/CVE-2025-22621 In versions 1.0.67 and lower of the Splunk App for SOAR, the Splunk documentation for that app recommended adding the `admin_all_objects` capability to the `splunk_app_soar` role. This addition could lead to improper access control for a low-privileg… Medium Tue, 07 Jan 2025 16:48:32 GMT https://vulnogram.org/CVE-2024-53244 https://vulnogram.org/CVE-2024-53244 In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.2.2406.107, 9.2.2403.109, and 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search w… Medium Tue, 10 Dec 2024 18:01:24 GMT https://vulnogram.org/CVE-2024-53246 https://vulnogram.org/CVE-2024-53246 In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.111, and 9.1.2312.206, an SPL command can potentially disclose sensitive information. The vulnerability requires… Medium Tue, 10 Dec 2024 18:01:16 GMT https://vulnogram.org/CVE-2024-53243 https://vulnogram.org/CVE-2024-53243 In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and versions below 3.2.462, 3.7.18, and 3.8.5 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could se… Medium Tue, 10 Dec 2024 18:00:49 GMT https://vulnogram.org/CVE-2024-53245 https://vulnogram.org/CVE-2024-53245 In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles, that has a username with the same name as a role with rea… Low Tue, 10 Dec 2024 18:00:33 GMT https://vulnogram.org/CVE-2024-53247 https://vulnogram.org/CVE-2024-53247 In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7, and versions below 3.4.261 and 3.7.13 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could perform a… High Tue, 10 Dec 2024 18:00:24 GMT https://vulnogram.org/CVE-2024-45739 https://vulnogram.org/CVE-2024-45739 In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users. This exposure could happen when you configure the Splunk Enterprise AdminManager log chann… Medium Mon, 14 Oct 2024 17:03:38 GMT https://vulnogram.org/CVE-2024-45738 https://vulnogram.org/CVE-2024-45738 In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure could happen if you configure the Splunk Enterprise `REST_Calls` log channel at the DEBUG… Medium Mon, 14 Oct 2024 17:03:38 GMT https://vulnogram.org/CVE-2024-45737 https://vulnogram.org/CVE-2024-45737 In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state… Medium Mon, 14 Oct 2024 17:03:37 GMT https://vulnogram.org/CVE-2024-45733 https://vulnogram.org/CVE-2024-45733 In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration. High Mon, 14 Oct 2024 17:03:36 GMT https://vulnogram.org/CVE-2024-45732 https://vulnogram.org/CVE-2024-45732 In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk role… High Mon, 14 Oct 2024 17:03:35 GMT https://vulnogram.org/CVE-2024-45736 https://vulnogram.org/CVE-2024-45736 In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query… Medium Mon, 14 Oct 2024 17:03:34 GMT https://vulnogram.org/CVE-2024-45741 https://vulnogram.org/CVE-2024-45741 In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a malicious payload through a custom… Medium Mon, 14 Oct 2024 17:03:33 GMT https://vulnogram.org/CVE-2024-45734 https://vulnogram.org/CVE-2024-45734 In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboa… Medium Mon, 14 Oct 2024 17:03:30 GMT https://vulnogram.org/CVE-2024-45740 https://vulnogram.org/CVE-2024-45740 In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through Scheduled Views that could res… Medium Mon, 14 Oct 2024 17:03:29 GMT https://vulnogram.org/CVE-2024-45731 https://vulnogram.org/CVE-2024-45731 In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows… High Mon, 14 Oct 2024 16:46:01 GMT https://vulnogram.org/CVE-2024-45735 https://vulnogram.org/CVE-2024-45735 In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the "admin" or "power" Splunk roles can see App Key V… Medium Mon, 14 Oct 2024 16:45:54 GMT https://vulnogram.org/CVE-2024-36997 https://vulnogram.org/CVE-2024-36997 In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in the browser context of another Splunk user through the conf-web/setting… Medium Mon, 01 Jul 2024 16:57:47 GMT https://vulnogram.org/CVE-2024-36993 https://vulnogram.org/CVE-2024-36993 In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a Sp… Medium Mon, 01 Jul 2024 16:54:35 GMT https://vulnogram.org/CVE-2024-36995 https://vulnogram.org/CVE-2024-36995 In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could create experimental items. Medium Mon, 01 Jul 2024 16:52:57 GMT https://vulnogram.org/CVE-2024-36982 https://vulnogram.org/CVE-2024-36982 In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash… High Mon, 01 Jul 2024 16:31:04 GMT https://vulnogram.org/CVE-2024-36991 https://vulnogram.org/CVE-2024-36991 In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Window… High Mon, 01 Jul 2024 16:31:03 GMT https://vulnogram.org/CVE-2024-36990 https://vulnogram.org/CVE-2024-36990 In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an authenticated, low-privileged user that does not hold the admin or power Splunk roles could send a specially crafted HTTP POST requ… Medium Mon, 01 Jul 2024 16:30:57 GMT https://vulnogram.org/CVE-2024-36985 https://vulnogram.org/CVE-2024-36985 In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application. High Mon, 01 Jul 2024 16:30:57 GMT https://vulnogram.org/CVE-2024-36992 https://vulnogram.org/CVE-2024-36992 In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a Vi… Medium Mon, 01 Jul 2024 16:30:51 GMT https://vulnogram.org/CVE-2024-36984 https://vulnogram.org/CVE-2024-36984 In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code. High Mon, 01 Jul 2024 16:30:44 GMT https://vulnogram.org/CVE-2024-36986 https://vulnogram.org/CVE-2024-36986 In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safegu… Medium Mon, 01 Jul 2024 16:30:42 GMT https://vulnogram.org/CVE-2024-36983 https://vulnogram.org/CVE-2024-36983 In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user could create an external lookup that calls a legacy internal function. The authenticated user c… High Mon, 01 Jul 2024 16:30:41 GMT https://vulnogram.org/CVE-2024-36996 https://vulnogram.org/CVE-2024-36996 In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likel… Medium Mon, 01 Jul 2024 16:30:41 GMT https://vulnogram.org/CVE-2024-36994 https://vulnogram.org/CVE-2024-36994 In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a Vi… Medium Mon, 01 Jul 2024 16:30:40 GMT https://vulnogram.org/CVE-2024-36989 https://vulnogram.org/CVE-2024-36989 In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold the admin or power Splunk roles could create notifications in Splunk Web Bulletin Messages th… Medium Mon, 01 Jul 2024 16:30:38 GMT https://vulnogram.org/CVE-2024-36987 https://vulnogram.org/CVE-2024-36987 In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the admin or power Splunk roles could upload a file with an arbitrary extensio… Medium Mon, 01 Jul 2024 16:30:36 GMT https://vulnogram.org/CVE-2024-29945 https://vulnogram.org/CVE-2024-29945 In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the software potentially exposes authentication tokens during the token validation process. This exposure happens when either Splunk Enterprise runs in debug mode or the JsonWebToken compon… High Wed, 27 Mar 2024 16:16:00 GMT https://vulnogram.org/CVE-2024-29946 https://vulnogram.org/CVE-2024-29946 In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attack… High Wed, 27 Mar 2024 16:15:59 GMT https://vulnogram.org/CVE-2023-46230 https://vulnogram.org/CVE-2023-46230 In Splunk Add-on Builder versions below 4.1.4, the app writes sensitive information to internal log files. High Tue, 30 Jan 2024 17:00:49 GMT https://vulnogram.org/CVE-2023-46231 https://vulnogram.org/CVE-2023-46231 In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the Splunk Add-on Builder or when you build or edit a custom app or add-on. High Tue, 30 Jan 2024 17:00:46 GMT https://vulnogram.org/CVE-2024-23678 https://vulnogram.org/CVE-2024-23678 In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerabi… High Mon, 22 Jan 2024 20:37:43 GMT https://vulnogram.org/CVE-2024-23676 https://vulnogram.org/CVE-2024-23676 In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit. Medium Mon, 22 Jan 2024 20:37:42 GMT https://vulnogram.org/CVE-2024-23677 https://vulnogram.org/CVE-2024-23677 In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file. Medium Mon, 22 Jan 2024 20:37:41 GMT https://vulnogram.org/CVE-2024-23675 https://vulnogram.org/CVE-2024-23675 In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store col… Medium Mon, 22 Jan 2024 20:37:23 GMT https://vulnogram.org/CVE-2024-22164 https://vulnogram.org/CVE-2024-22164 In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation. The attachment endpoint does not properly limit the size of the request which lets an at… Medium Tue, 09 Jan 2024 17:01:07 GMT https://vulnogram.org/CVE-2024-22165 https://vulnogram.org/CVE-2024-22165 In Splunk Enterprise Security (ES) versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service (DoS). The malformed investigation prevents the generation and rendering of the Investigations manager until… Medium Tue, 09 Jan 2024 17:01:04 GMT https://vulnogram.org/CVE-2023-46213 https://vulnogram.org/CVE-2023-46213 In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web browser. Medium Thu, 16 Nov 2023 20:15:46 GMT https://vulnogram.org/CVE-2023-46214 https://vulnogram.org/CVE-2023-46214 In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote… High Thu, 16 Nov 2023 20:15:25 GMT https://vulnogram.org/CVE-2023-40597 https://vulnogram.org/CVE-2023-40597 In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk. High Wed, 30 Aug 2023 16:19:44 GMT https://vulnogram.org/CVE-2023-40596 https://vulnogram.org/CVE-2023-40596 In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and subsequently… High Wed, 30 Aug 2023 16:19:43 GMT https://vulnogram.org/CVE-2023-40593 https://vulnogram.org/CVE-2023-40593 In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Sp… Medium Wed, 30 Aug 2023 16:19:41 GMT https://vulnogram.org/CVE-2023-40594 https://vulnogram.org/CVE-2023-40594 In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance. Medium Wed, 30 Aug 2023 16:19:40 GMT https://vulnogram.org/CVE-2023-4571 https://vulnogram.org/CVE-2023-4571 In Splunk IT Service Intelligence (ITSI) versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject American National Standards Institute (ANSI) escape codes into Splunk ITSI log files that, when a vulnerable terminal application re… High Wed, 30 Aug 2023 16:19:39 GMT