DeutschShown in its original language — a full translation is planned for a future version.
Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern
view advisory published 2023-06-01
Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise in diversen Komponenten von Drittanbietern ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
01
describes (129)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-27538US | medium5.5 | — | ||
An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, w… | ||||
| CVE-2023-27537US | medium5.9 | — | ||
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing acros… | ||||
| CVE-2023-27536US | medium5.9 | — | ||
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due… | ||||
| CVE-2023-27535US | medium5.9 | — | ||
An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Pre… | ||||
| CVE-2023-27534US | high8.8 | — | ||
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in a… | ||||
| CVE-2023-27533US | high8.8 | — | ||
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet op… | ||||
| CVE-2023-1370US | high7.5 | — | ||
[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib.
When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array… | ||||
| CVE-2023-23916US | medium6.5 | — | ||
An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can… | ||||
| CVE-2023-23915US | medium6.5OT elevated | — | ||
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested i… | ||||
| CVE-2023-23914US | critical9.1OT elevated | — | ||
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using it… | ||||
| CVE-2022-43552US | medium5.9 | — | ||
A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny… | ||||
| CVE-2023-0286US | high7.4 | — | ||
There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure def… | ||||
| CVE-2023-0215US | high7.5 | — | ||
The public API function BIO_new_NDEF is a helper function used for streaming
ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the
SMIME, CMS and PKCS7 st… | ||||
| CVE-2022-4304US | medium5.9 | Exploit | ||
A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichenbacher style attack.… | ||||
| CVE-2022-4200US | medium4.8 | — | ||
The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cros… | ||||
| CVE-2022-46175US | high8.8 | Exploit | ||
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before a… | ||||
| CVE-2022-43551US | high7.5OT elevated | — | ||
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of usin… | ||||
| CVE-2022-23491US | high7.5OT elevated | — | ||
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes ro… | ||||
| CVE-2022-41720US | high7.5 | — | ||
On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These… | ||||
| CVE-2022-35260US | medium6.5 | — | ||
curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the en… | ||||
showing 20 of 129
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:34342 vom 2026-07-01external
- Splunk Enterprise Security Advisory SVD-2023-0613 vom 2023-06-01external
- Atlassian Security Bulletin - November 18 2025external
- SUSE Security Update SUSE-SU-2024:0487-1 vom 2024-02-15external
- SUSE Security Update SUSE-SU-2024:0486-1 vom 2024-02-15external
- SUSE Security Update SUSE-SU-2024:0196-1 vom 2024-01-23external
- WID-SEC-W-2023-1350 - CSAF Versionself
- WID-SEC-2023-1350 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan