DeutschShown in its original language — a full translation is planned for a future version.
Splunk Enterprise: Mehrere Schwachstellen
view advisory published 2024-01-09
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Splunk Enterprise ausnutzen, um beliebigen Programmcode auszuführen, einen Denial of Service Zustand herbeizuführen oder unbekannte Auswirkungen zu verursachen.
01
describes (15)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-22165US | medium6.5 | — | ||
In Splunk Enterprise Security (ES) versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service (DoS). The malformed investigation pre… | ||||
| CVE-2024-22164US | medium4.3 | — | ||
In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation. The attachment end… | ||||
| CVE-2023-45133US | high8.8 | — | ||
Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that wa… | ||||
| CVE-2022-25883US | high7.5 | — | ||
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a ran… | ||||
| CVE-2023-2976US | high7.1 | — | ||
Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows o… | ||||
| CVE-2023-32695US | high7.5 | — | ||
socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaug… | ||||
| CVE-2022-46175US | high8.8 | Exploit | ||
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before a… | ||||
| CVE-2022-3510US | high7.5 | — | ||
A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial o… | ||||
| CVE-2022-3509US | high7.5 | Exploit | ||
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service att… | ||||
| CVE-2022-37603US | high7.5 | — | ||
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateNam… | ||||
| CVE-2022-3171US | high7.5 | — | ||
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multip… | ||||
| CVE-2022-37601US | critical9.8 | — | ||
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 a… | ||||
| CVE-2022-37599US | high7.5 | — | ||
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in inter… | ||||
| CVE-2021-23446US | high7.5 | — | ||
The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNu… | ||||
| CVE-2015-5237US | high8.8 | — | ||
protobuf allows remote authenticated attackers to cause a heap-based buffer overflow. | ||||
02
references
External citations — patches, advisories, analysis.
- Splunk Security Advisory SVD-2024-0101 vom 2024-01-09external
- Splunk Security Advisory SVD-2024-0102 vom 2024-01-09external
- Splunk Security Advisory SVD-2024-0103 vom 2024-01-09external
- Splunk Security Advisory SVD-2024-0104 vom 2024-01-09external
- Splunk Security Advisory SVD-2024-0112 vom 2024-01-30external
- Splunk Security Advisory SVD-2024-0718 vom 2024-07-02external
- Atlassian Security Bulletin - November 18 2025external
- WID-SEC-W-2024-0049 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan