Splunk vulnerabilities
Published CVEs affecting Splunk products: 233 record(s), with severity, exploitation and fixes.
Splunk 121Splunk Enterprise 120Universal Forwarder 54Splunk Cloud Platform 32Splunk SOAR 16Splunk Secure Gateway 13Ai Toolkit 12Connect For Kafka 4AD LDAP app for Splunk SOAR 3Splunk MCP Server 3Cisco Talos Intelligence for Enterprise Security Cloud 2Enterprise Security 2Cisco Webex app for Splunk SOAR 1Splunk On-Call (VictorOps) 1Splunk MCP Server app 1Zoom app for Splunk SOAR 1Venafi app for Splunk SOAR 1Splunk Attack Analyzer Connector for Splunk SOAR 1RSA SecurID Authentication Manager app for Splunk SOAR 1Phantom app for Splunk SOAR 1MS Graph for Active Directory app for Splunk SOAR 1CrowdStrike OAuth API app for Splunk SOAR 1Cisco Secure Malware Analytics app for Splunk SOAR 1Azure AD Graph app for Splunk SOAR 1AWS IAM app for Splunk SOAR 1Nmap Scanner 1FireAMP 1On-call 1Model Context Protocol Server 1Splunk Add-on for Palo Alto Networks 1
CVE-2020-8177
High · 7.8
CWE-74 Dec 14, 2020
Injection in Haxx Curl
curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.
CVE-2020-8285
High · 7.5
CWE-674 Dec 14, 2020
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack...
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
CVE-2020-8284
Low · 3.7
CWE-200 Dec 14, 2020
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting...
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
CVE-2020-8231
High · 7.5
CWE-416 Dec 14, 2020
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when...
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
CVE-2020-8169
High · 7.5
CWE-200 Dec 14, 2020
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead...
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).
CVE-2020-14155
Medium · 5.3
CWE-190 Jun 15, 2020
Integer Overflow or Wraparound in Pcre
libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
CVE-2019-20838
High · 7.5
CWE-125 Jun 15, 2020
Out-of-bounds Read in Pcre
libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.
CVE-2014-0160
High · 7.5
KEV Urgent · 79 Public exploit CWE-125 Apr 7, 2014
OpenSSL Information Disclosure Vulnerability
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.