SVDDateTitleSeverityCVE
SVD-2023-02152023-02-14 February Third Party Package Updates in Splunk EnterpriseHigh -
SVD-2023-02142023-02-14 Splunk Response to the Apache Software Foundation Publishing a Vulnerability on Apache Commons Text (CVE-2022-42889) (Text4Shell)Info -
SVD-2023-02132023-02-14 Modular Input REST API Requests Connect via HTTP after Certificate Validation Failure in Splunk Add-on Builder and Splunk CloudConnect SDKMedium CVE-2023-22943
SVD-2023-02122023-02-14 Cross-Site Request Forgery in the ‘ssg/kvstore_client’ REST Endpoint in Splunk EnterpriseMedium CVE-2023-22942
SVD-2023-02112023-02-14 Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk DaemonMedium CVE-2023-22941
SVD-2023-02102023-02-14 SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk EnterpriseMedium CVE-2023-22940
SVD-2023-02092023-02-14 SPL Command Safeguards Bypass via the ‘map’ SPL Command in Splunk EnterpriseHigh CVE-2023-22939
SVD-2023-02082023-02-14 Permissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk EnterpriseMedium CVE-2023-22938
SVD-2023-02072023-02-14 Unnecessary File Extensions Allowed by Lookup Table Uploads in Splunk EnterpriseMedium CVE-2023-22937
SVD-2023-02062023-02-14 Authenticated Blind Server Side Request Forgery via the ‘search_listener’ Search Parameter in Splunk EnterpriseMedium CVE-2023-22936
SVD-2023-02052023-02-14 SPL Command Safeguards Bypass via the ‘display.page.search.patterns.sensitivity’ Search Parameter in Splunk EnterpriseHigh CVE-2023-22935
SVD-2023-02042023-02-14 SPL Command Safeguards Bypass via the ‘pivot’ SPL Command in Splunk EnterpriseHigh CVE-2023-22934
SVD-2023-02032023-02-14 Persistent Cross-Site Scripting through the ‘module’ Tag in a View in Splunk EnterpriseHigh CVE-2023-22933
SVD-2023-02022023-02-14 Persistent Cross-Site Scripting through a Base64-encoded Image in a View in Splunk EnterpriseHigh CVE-2023-22932
SVD-2023-02012023-02-14 ‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk EnterpriseMedium CVE-2023-22931
SVD-2022-11112022-11-02 Remote Code Execution through dashboard PDF generation component in Splunk EnterpriseHigh CVE-2022-43571
SVD-2022-11132022-11-02 November Third Party Package updates in Splunk EnterpriseHigh -
SVD-2022-11122022-11-02 Indexing blockage via malformed data sent through S2S or HEC protocols in Splunk EnterpriseHigh CVE-2022-43572
SVD-2022-11102022-11-02 XML External Entity Injection through a custom View in Splunk EnterpriseHigh CVE-2022-43570
SVD-2022-11092022-11-02 Persistent Cross-Site Scripting via a Data Model object name in Splunk EnterpriseHigh CVE-2022-43569
SVD-2022-11082022-11-02 Reflected Cross-Site Scripting via the radio template in Splunk EnterpriseHigh CVE-2022-43568
SVD-2022-11072022-11-02 Remote Code Execution via the Splunk Secure Gateway application Mobile Alerts featureHigh CVE-2022-43567
SVD-2022-11062022-11-02 Risky command safeguards bypass via Search ID query in Analytics Workspace in Splunk EnterpriseHigh CVE-2022-43566
SVD-2022-11052022-11-02 Risky command safeguards bypass via ‘tstats’ command JSON in Splunk EnterpriseHigh CVE-2022-43565
SVD-2022-11042022-11-02 Denial of Service in Splunk Enterprise through search macrosMedium CVE-2022-43564
SVD-2022-11032022-11-02 Risky command safeguards bypass via 'rex' search command field names in Splunk EnterpriseHigh CVE-2022-43563
SVD-2022-11022022-11-02 Host Header Injection in Splunk EnterpriseLow CVE-2022-43562
SVD-2022-11012022-11-02 Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk EnterpriseMedium CVE-2022-43561
SVD-2022-11142022-11-01 Splunk’s response to OpenSSL’s CVE-2022-3602 and CVE-2022-3786High -
SVD-2022-08042022-08-16 August Third Party Package updates in Splunk Enterprise and Universal ForwardersMedium -
SVD-2022-08032022-08-16 Malformed ZIP file crashes Universal Forwarders and Splunk Enterprise through file monitoring inputMedium CVE-2022-37439
SVD-2022-08022022-08-16 Information disclosure via the dashboard drilldown in Splunk EnterpriseLow CVE-2022-37438
SVD-2022-08012022-08-16 Ingest Actions UI in Splunk Enterprise 9.0.0 disabled TLS certificate validationHigh CVE-2022-37437
SVD-2022-06082022-08-16 Splunk Enterprise deployment servers allow client publishing of forwarder bundlesCritical CVE-2022-32158
SVD-2022-06072022-08-16 Splunk Enterprise deployment servers allow unauthenticated forwarder bundle downloadsHigh CVE-2022-32157
SVD-2022-06062022-06-14 Splunk Enterprise and Universal Forwarder CLI connections lacked TLS certificate validationHigh CVE-2022-32156
SVD-2022-06052022-06-14 Universal Forwarder management services allow remote login by defaultInfo CVE-2022-32155
SVD-2022-06042022-06-14 Risky commands warnings in Splunk Enterprise dashboardsMedium CVE-2022-32154
SVD-2022-06032022-06-14 Splunk Enterprise lacked TLS host name certificate validationHigh CVE-2022-32153
SVD-2022-06022022-06-14 Splunk Enterprise lacked TLS certificate validation for Splunk-to-Splunk communication by defaultHigh CVE-2022-32152
SVD-2022-06012022-06-14 Splunk Enterprise disabled TLS validation using the CA certificate stores in Python 3 libraries by defaultHigh CVE-2022-32151
SVD-2022-05072022-05-03 Error message discloses internal pathMedium CVE-2022-26070
SVD-2022-05062022-05-03 Path Traversal in search parameter results in external content injectionHigh CVE-2022-26889
SVD-2022-05052022-05-03 Reflected XSS in a query parameter of the Monitoring ConsoleHigh CVE-2022-27183
SVD-2022-05042022-05-03 Bypass of Splunk Enterprise's implementation of DUO MFAHigh CVE-2021-26253
SVD-2022-05032022-05-03 S2S TcpToken authentication bypass High CVE-2021-31559
SVD-2022-05022022-05-03 Username enumeration through lockout message in REST APIMedium CVE-2021-33845
SVD-2022-05012022-05-03 Local privilege escalation via a default path in Splunk Enterprise WindowsHigh CVE-2021-42743
SVD-2022-03012022-03-24 Indexer denial-of-service via malformed S2S requestHigh CVE-2021-3422
SVD-2021-12012021-12-10 Splunk Security Advisory for Apache Log4j (CVE-2021-44228, CVE-2021-45046 and others)Critical -
SP-CAAAQAF2019-02-19 Persistent Cross Site Scripting in Splunk Web (SPL-138827, CVE-2019-5727)High -
SP-CAAAQAD2019-01-14 Untrusted TLS server certs verification is not present (CVE-2019-5729)High -
SP-CAAAP5T2018-09-28 Splunk Enterprise and Splunk Light address multiple vulnerabilitiesHigh -
SP-CAAAP5E2018-06-18 Splunk response to CVE-2018-11409: Information ExposureLow -
SP-CAAAPUE2017-12-15 Splunk Enterprise 6.4.5 addresses multiple vulnerabilities- -
SP-CAAAP3M2017-11-27 Splunk response to Potential Local Privilege Escalation through instructions to run Splunk as non-root userHigh -
SP-CAAAP3K2017-11-14 Splunk Enterprise 7.0.0.1/7.0.1, 6.6.3.2/6.6.4, 6.5.6, 6.4.9 and 6.3.12 address multiple SAML vulnerabilitiesSplunk Enterprise and Splunk Light address multiple vulnerabilitiesCritical -
SP-CAAAP3H2017-08-21 Splunk Enterprise 6.6.3 and Splunk Light 6.6.3 address multiple vulnerabilitiesHigh -
SP-CAAAP2U2017-06-06 Splunk Enterprise 6.3.11 and Splunk Light 6.5.3 address one vulnerabilityLow -
SP-CAAAPZ32017-05-05 Splunk Enterprise 6.5.3, 6.2.13.1 and Splunk Light 6.5.2 address multiple vulnerabilitiesMedium -
ERP-20412017-05-05 Splunk response to Path Traversal vulnerability in Splunk Hadoop Connect AppHigh -
SP-CAAAP2K2017-03-24 Splunk Enterprise 6.4.7 and Splunk Light 6.5.3 address multiple vulnerabilitiesMedium -
SP-CAAAPYC2017-02-23 Splunk Enterprise 6.4.6 and Splunk Light 6.5.2 address one vulnerabilityMedium -
SP-CAAAPW82017-01-25 Splunk Enterprise 6.2.13 addresses multiple vulnerabilitiesMedium -
SP-CAAAPSV2016-11-12 Splunk Enterprise 6.5.1 addresses multiple OpenSSL vulnerabilities- -
SP-CAAAPSR2016-11-10 Splunk Enterprise 6.5.0, 6.4.4, 6.3.8, 6.2.12, 6.1.12, 6.0.13, and 5.0.17 address multiple vulnerabilitiess- -
SP-CAAAPQ62016-08-22 Splunk Enterprise 6.4.3 and Splunk Light 6.4.3 address one vulnerabilityMedium -
SP-CAAAPQM2016-07-28 Splunk Enterprise 6.4.2, 6.3.6, 6.2.11, 6.1.11, 6.0.12, 5.0.16 and Splunk Light 6.4.2 address multiple security vulnerabilitiesMedium -
SP-CAAAPN92016-06-06 Splunk Enterprise 6.3.5 and Splunk Light 6.3.5 address two vulnerabilitiesMedium -
SP-CAAAPKV2016-04-06 Splunk Enterprise 6.3.3.4, 6.2.9. 6.1.10, 6.0.11, and 5.0.15 and Splunk Light 6.3.3.4 and 6.2.9 address multiple vulnerabilitiesMedium -
SP-CAAAPC32015-11-19 Splunk response to Path Traversal vulnerability in Splunk Hadoop Connect AppMedium -
SP-CAAAPAM2015-09-14 Splunk 4.2.3 addresses two vulnerabilitiesHigh -
SP-CAAAN7C2015-07-07 Splunk Enterprise 6.2.4 and Splunk Light 6.2.4 address two vulnerabilitiesMedium -
SP-CAAAN4P2015-05-27 Splunk Enterprise 6.1.8, 6.0.9, and 5.0.13 address multiple vulnerabilitiesLow -
SP-CAAAN842015-05-11 Splunk Enterprise 6.2.5, 6.1.9, 6.0.10, 5.0.14 and Splunk Light 6.2.5 address multiple vulnerabilitiesMedium -
SP-CAAANZ72015-04-30 Splunk Enterprise 6.2.3 and Splunk Light 6.2.3 address five vulnerabilitiesHigh -
SP-CAAANXD2015-03-24 Splunk Enterprise 6.2.2 addresses two vulnerabilitiesMedium -
SP-CAAANV82015-02-23 Splunk Enterprise 6.2.2 addresses two vulnerabilitiesHigh -
SP-CAAANVJ2015-01-28 Splunk response to "GHOST" Vulnerability (CVE-2015-0235)High -
SP-CAAANU52015-01-28 Splunk response to January 2015 OpenSSL vulnerabilitiesHigh -
SP-CAAANST2014-11-19 Splunk Enterprise versions 6.0.7 and 5.0.11 address three vulnerabilities -
SP-CAAANR72014-11-11 Splunk Enterprise 6.1.5 addresses two vulnerabilities -
SP-CAAANKE2014-10-14 Splunk response to SSLv3 "POODLE" vulnerability (CVE-2014-3566) -
SP-CAAANHS2014-09-30 Splunk Enterprise 6.1.4 and 5.0.10 address four vulnerabilities -
SP-CAAANJN2014-09-29 Splunk response to "shellshock" vulnerabilities -
SP-CAAANE22014-09-03 Splunk Enterprise 6.0.6 addresses two vulnerabilities -
SP-CAAAM9H2014-08-04 Splunk Enterprise 6.1.3 addresses two vulnerabilities -
SP-CAAAM2D2014-07-01 Splunk 6.0.3 addresses two vulnerabilities -
SP-CAAAMSH2014-05-09 Splunk Enterprise 6.0.4 addresses one vulnerability -
SP-CAAAMB32014-04-10 Splunk 6.0.3 addresses two vulnerabilities -
SP-CAAAKQX2014-03-28 Splunk 5.0.8 addresses one vulnerability -
SP-CAAAJD52013-12-17 Splunk 6.0.1 addresses one vulnerability -
SP-CAAAJCD2013-11-15 Splunk 5.0.6 addresses one vulnerability -
SP-CAAAH762013-09-23 Splunk 5.0.5 addresses one vulnerability -
SP-CAAAH322013-07-29 Splunk 5.0.4 addresses one vulnerability- -
SP-CAAAHXG2013-05-28 Splunk 5.0.3 addresses multiple vulnerabilities -
SP-CAAAHSQ2013-04-20 Splunk 4.3.6 addresses one vulnerability -
SP-CAAAHB42012-11-16 Splunk 4.3.5 and 5.0 address three vulnerabilities -
SP-CAAAHDG2012-11-01 Splunk 5.0 updates to python 2.7.3, addressing two vulnerabilities -
SP-CAAAGTK2012-03-05 Splunk 4.3.1 addresses one vulnerability -
SP-CAAAGMM2011-12-12 Splunk 4.2.5 addresses three vulnerabilities -
SP-CAAAGGH2011-10-19 Splunk 4.2.4 addresses two vulnerabilities -
SP-CAAAGD32011-08-09 Splunk 4.2.3 addresses two vulnerabilities -
SP-CAAAF722011-06-15 Open Redirect in Splunk Web -
SP-CAAAF5K2011-04-18 Reflected XSS with Splunk Web -
SP-CAAAFW62011-02-10 Splunk 4.1.7 addresses five security vulnerabilities -
SP-CAAAFVU2010-12-01 Splunk 4.1.6 updates OpenSSL to 0.9.8p address CVE-2010-3864 -
SP-CAAAFQ62010-09-09 Splunk 4.1.5 addresses two security vulnerabilities -
SP-CAAAFHY2010-06-07 Cross-site Scripting in Splunk Web with 404 Responses in Internet Explorer -
SP-CAAAFGS2010-05-10 Vulnerability in example PAM authentication script -
SP-CAAAFGD2010-05-03 Splunk Critical Maintenance Release and Patch -