CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2014-5197
https://notcve.org/view.php?id=CVE-2014-5197
12 Aug 2014 — Directory traversal vulnerability in (1) Splunk Web or the (2) Splunkd HTTP Server in Splunk Enterprise 6.1.x before 6.1.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a URI, related to search ids. Vulnerabilidad de salto de directorio en (1) Splunk Web o (2) Splunkd HTTP Server en Splunk Enterprise 6.1.x anterior a 6.1.3 permite a usuarios remotos autenticados leer ficheros arbitrarios a través de un .. (punto punto) en una URI, relacionado con 'search ids'. • http://secunia.com/advisories/59940 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2014-5198
https://notcve.org/view.php?id=CVE-2014-5198
12 Aug 2014 — Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.1.x before 6.1.3 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header. Vulnerabilidad de XSS en Splunk Web en Splunk Enterprise 6.1.x anterior a 6.1.3 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de la cabecera Referer HTTP. • http://secunia.com/advisories/59940 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 5EXPL: 0CVE-2013-7394
https://notcve.org/view.php?id=CVE-2013-7394
07 Aug 2014 — The "runshellscript echo.sh" script in Splunk before 5.0.5 allows remote authenticated users to execute arbitrary commands via a crafted string. NOTE: this issue was SPLIT from CVE-2013-6771 per ADT2 due to different vulnerability types. La secuencia de comandos 'runshellscript echo.sh' en Splunk anterior a 5.0.5 permite a usuarios remotos autenticados ejecutar código arbitrario a través de una cadena manipulada. NOTE: este problema fue dividido (SPLIT) del CVE-2013-6771 por ADT2 debido a tipos de vulnerabi... • http://www.splunk.com/view/SP-CAAAH76 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 94%CPEs: 54EXPL: 84CVE-2014-0160 – OpenSSL Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2014-0160
07 Apr 2014 — The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. Las implementaciones de (1) TLS y (2) DTLS en OpenSSL 1.0.1 en versiones anteriores a 1.0.1g no manejan adecuadamente paquetes Heartbeat Extension, lo qu... • https://packetstorm.news/files/id/180746 • CWE-125: Out-of-bounds Read CWE-201: Insertion of Sensitive Information Into Sent Data •
CVSS: 9.3EPSS: 5%CPEs: 5EXPL: 0CVE-2013-6771 – Splunk runshellscript echo.sh Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-6771
03 Apr 2014 — Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the file parameter. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2013-7394 is for the issue in the "runshellscript echo.sh" script. Vulnerabilidad de salto de directorio en la secuencia de comandos collect en Splunk anterior a 5.0.5 permite a atacantes remotos ejecutar comandos arbitrarios a través de un .. • http://www.splunk.com/view/SP-CAAAH76 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2014-2578
https://notcve.org/view.php?id=CVE-2014-2578
02 Apr 2014 — Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Splunk Web en Splunk anterior a 5.0.8 permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de vectores no especificados. • http://secunia.com/advisories/57554 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2012-6447
https://notcve.org/view.php?id=CVE-2012-6447
23 Jan 2014 — Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 5.0.0 through 5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de cross-site scripting (XSS) en Splunk Web Splunk 5.0.0 a 5.0.2 permite a atacantes remotos inyectar scripts web o HTML arbitrarios a través de vectores no especificados. • http://osvdb.org/93745 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 80EXPL: 0CVE-2013-6870
https://notcve.org/view.php?id=CVE-2013-6870
25 Nov 2013 — Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Splunk Web de Splunk anterior a la versión 5.0.6 permite a atacantes remotos inyectar script web o HTML arbitrario a través de vectores sin especificar. • http://secunia.com/advisories/55774 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2013-2766
https://notcve.org/view.php?id=CVE-2013-2766
10 Apr 2013 — Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 4.3.0 through 4.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en Splunk Web en Splunk v4.3.0 hasta v4.3.5 que permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://www.securityfocus.com/bid/59038 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 27EXPL: 0CVE-2012-1908
https://notcve.org/view.php?id=CVE-2012-1908
17 Aug 2012 — Cross-site scripting (XSS) vulnerability in Splunk 4.0 through 4.3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en Splunk v4.0 a v4.3 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores desconocidos. • http://www.splunk.com/view/SP-CAAAGTK#38585 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •