Page 4 of 49 results (0.061 seconds)

CVSS: 6.1EPSS: 0%CPEs: 21EXPL: 0

CVE-2014-8302

https://notcve.org/view.php?id=CVE-2014-8302

16 Oct 2014 — Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.1.x before 6.1.4, 6.0.x before 6.0.6, and 5.0.x before 5.0.10 allows remote attackers to inject arbitrary web script or HTML via vectors related to dashboard. Vulnerabilidad de XSS en Splunk Web en Splunk Enterpirse 6.1.x anterior a 6.1.x anterior a 6.1.4, 6.0.x anterior a 6.0.6, y 5.0.x anterior a 5.0.10 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores relacionados con dashbo... • http://www.securitytracker.com/id/1030994 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0

CVE-2014-3147

https://notcve.org/view.php?id=CVE-2014-3147

10 Oct 2014 — Cross-site scripting (XSS) vulnerability in the auto-complete feature in Splunk Enterprise before 6.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a CSV file. Vulnerabilidad de XSS en la caracteristica de autocompletado en Splunk Enterprise anterior a 6.0.4 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de un fichero CSV. • http://securitytracker.com/id?1030800 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.0EPSS: 0%CPEs: 5EXPL: 0

CVE-2013-7394

https://notcve.org/view.php?id=CVE-2013-7394

07 Aug 2014 — The "runshellscript echo.sh" script in Splunk before 5.0.5 allows remote authenticated users to execute arbitrary commands via a crafted string. NOTE: this issue was SPLIT from CVE-2013-6771 per ADT2 due to different vulnerability types. La secuencia de comandos 'runshellscript echo.sh' en Splunk anterior a 5.0.5 permite a usuarios remotos autenticados ejecutar código arbitrario a través de una cadena manipulada. NOTE: este problema fue dividido (SPLIT) del CVE-2013-6771 por ADT2 debido a tipos de vulnerabi... • http://www.splunk.com/view/SP-CAAAH76 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 9.3EPSS: 5%CPEs: 5EXPL: 0

CVE-2013-6771 – Splunk runshellscript echo.sh Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2013-6771

03 Apr 2014 — Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the file parameter. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2013-7394 is for the issue in the "runshellscript echo.sh" script. Vulnerabilidad de salto de directorio en la secuencia de comandos collect en Splunk anterior a 5.0.5 permite a atacantes remotos ejecutar comandos arbitrarios a través de un .. • http://www.splunk.com/view/SP-CAAAH76 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0

CVE-2014-2578

https://notcve.org/view.php?id=CVE-2014-2578

02 Apr 2014 — Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Splunk Web en Splunk anterior a 5.0.8 permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de vectores no especificados. • http://secunia.com/advisories/57554 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0

CVE-2012-6447

https://notcve.org/view.php?id=CVE-2012-6447

23 Jan 2014 — Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 5.0.0 through 5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de cross-site scripting (XSS) en Splunk Web Splunk 5.0.0 a 5.0.2 permite a atacantes remotos inyectar scripts web o HTML arbitrarios a través de vectores no especificados. • http://osvdb.org/93745 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 80EXPL: 0

CVE-2013-6870

https://notcve.org/view.php?id=CVE-2013-6870

25 Nov 2013 — Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Splunk Web de Splunk anterior a la versión 5.0.6 permite a atacantes remotos inyectar script web o HTML arbitrario a través de vectores sin especificar. • http://secunia.com/advisories/55774 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0

CVE-2013-2766

https://notcve.org/view.php?id=CVE-2013-2766

10 Apr 2013 — Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 4.3.0 through 4.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en Splunk Web en Splunk v4.3.0 hasta v4.3.5 que permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://www.securityfocus.com/bid/59038 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 27EXPL: 0

CVE-2012-1908

https://notcve.org/view.php?id=CVE-2012-1908

17 Aug 2012 — Cross-site scripting (XSS) vulnerability in Splunk 4.0 through 4.3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en Splunk v4.0 a v4.3 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores desconocidos. • http://www.splunk.com/view/SP-CAAAGTK#38585 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 19%CPEs: 5EXPL: 4

CVE-2011-4642 – Splunk - Remote Command Execution

https://notcve.org/view.php?id=CVE-2011-4642

03 Jan 2012 — mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote authenticated administrators to execute arbitrary code by leveraging the sys module in a request to the search application, as demonstrated by a cross-site request forgery (CSRF) attack, aka SPL-45172. mappy.py de Web Splunk de Splunk 4.2.x anteriores a 4.2.5 no restringen apropiadamente el uso del comando "mappy" para acceder a clases Python, lo que permite a... • https://www.exploit-db.com/exploits/18245 • CWE-352: Cross-Site Request Forgery (CSRF) •