CVSS: 9.3EPSS: 5%CPEs: 5EXPL: 0CVE-2013-6771 – Splunk runshellscript echo.sh Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-6771
03 Apr 2014 — Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the file parameter. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2013-7394 is for the issue in the "runshellscript echo.sh" script. Vulnerabilidad de salto de directorio en la secuencia de comandos collect en Splunk anterior a 5.0.5 permite a atacantes remotos ejecutar comandos arbitrarios a través de un .. • http://www.splunk.com/view/SP-CAAAH76 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2014-2578
https://notcve.org/view.php?id=CVE-2014-2578
02 Apr 2014 — Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Splunk Web en Splunk anterior a 5.0.8 permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de vectores no especificados. • http://secunia.com/advisories/57554 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 80EXPL: 0CVE-2013-6870
https://notcve.org/view.php?id=CVE-2013-6870
25 Nov 2013 — Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Splunk Web de Splunk anterior a la versión 5.0.6 permite a atacantes remotos inyectar script web o HTML arbitrario a través de vectores sin especificar. • http://secunia.com/advisories/55774 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •