CVSS: 6.3EPSS: 0%CPEs: 4EXPL: 0CVE-2023-22940 – SPL Command Safeguards Bypass via the ‘collect’ SPL Command Aliases in Splunk Enterprise
https://notcve.org/view.php?id=CVE-2023-22940
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability requires a higher privileged user to initiate a request within their browser, and only affects instances with Splunk Web enabled. • https://advisory.splunk.com/advisories/SVD-2023-0210 https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd • CWE-20: Improper Input Validation •
CVSS: 5.9EPSS: 0%CPEs: 5EXPL: 1CVE-2022-43552 – curl: Use-after-free triggered by an HTTP proxy deny response
https://notcve.org/view.php?id=CVE-2022-43552
A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path. A vulnerability was found in curl. • http://seclists.org/fulldisclosure/2023/Mar/17 https://hackerone.com/reports/1764858 https://security.gentoo.org/glsa/202310-12 https://security.netapp.com/advisory/ntap-20230214-0002 https://support.apple.com/kb/HT213670 https://access.redhat.com/security/cve/CVE-2022-43552 https://bugzilla.redhat.com/show_bug.cgi?id=2152652 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 1CVE-2022-43551 – curl: HSTS bypass via IDN
https://notcve.org/view.php?id=CVE-2022-43551
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. • https://hackerone.com/reports/1755083 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TVWZW5CNSJ7UYAF2BGSYAWAEXDJYUBHA https://security.gentoo.org/glsa/202310-12 https://security.netapp.com/advisory/ntap-20230427-0007 https://access.redhat.com/security/cve/CVE-2022-43551 https://bugzilla.redhat.com/show_bug.cgi?id=2152639 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-36227 – libarchive: NULL pointer dereference in archive_write.c
https://notcve.org/view.php?id=CVE-2022-36227
In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution." En libarchive anterior a 3.6.2, el software no busca un error después de llamar a la función calloc que puede regresar con un puntero NULL si la función falla, lo que conduce a una desreferencia del puntero NULL resultante. NOTA: el descubridor cita este comentario CWE-476, pero terceros cuestionan el impacto de la ejecución del código: "En raras circunstancias, cuando NULL es equivalente a la dirección de memoria 0x0 y el código privilegiado puede acceder a ella, entonces es posible escribir o leer la memoria, lo cual puede llevar a la ejecución del código." A flaw was found in libarchive. • https://bugs.gentoo.org/882521 https://github.com/libarchive/libarchive/blob/v3.0.0a/libarchive/archive_write.c#L215 https://github.com/libarchive/libarchive/issues/1754 https://lists.debian.org/debian-lts-announce/2023/01/msg00034.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V67OO2UUQAUJS3IK4JZPF6F3LUCBU6IS https://security.gentoo.org/glsa/202309-14 https://access.redhat.com/security/cve/CVE-2022-36227 https://bugzilla.redhat.com/show_bug.cgi&# • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-43572 – Indexing blockage via malformed data sent through S2S or HEC protocols in Splunk Enterprise
https://notcve.org/view.php?id=CVE-2022-43572
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk (S2S) or HTTP Event Collector (HEC) protocols to an indexer results in a blockage or denial-of-service preventing further indexing. En las versiones de Splunk Enterprise inferiores a 8.2.9, 8.1.12 y 9.0.2, el envío de un archivo con formato incorrecto a través de los protocolos Splunk-to-Splunk (S2S) o HTTP Event Collector (HEC) a un indexador provoca un bloqueo o denegación fuera de servicio evitando una mayor indexación. • https://www.splunk.com/en_us/product-security/announcements/svd-2022-1111.html • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-400: Uncontrolled Resource Consumption •