DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Splunk Enterprise: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2024-01-09
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Splunk Enterprise ausnutzen, um beliebigen Programmcode auszuführen, einen Denial of Service Zustand herbeizuführen oder unbekannte Auswirkungen zu verursachen.
01
beschreibt (15)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-22165US | medium6.5 | — | ||
In Splunk Enterprise Security (ES) versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service (DoS). The malformed investigation pre… | ||||
| CVE-2024-22164US | medium4.3 | — | ||
In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation. The attachment end… | ||||
| CVE-2023-45133US | high8.8 | — | ||
Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that wa… | ||||
| CVE-2022-25883US | high7.5 | — | ||
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a ran… | ||||
| CVE-2023-2976US | high7.1 | — | ||
Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows o… | ||||
| CVE-2023-32695US | high7.5 | — | ||
socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaug… | ||||
| CVE-2022-46175US | high8.8 | Exploit | ||
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before a… | ||||
| CVE-2022-3510US | high7.5 | — | ||
A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial o… | ||||
| CVE-2022-3509US | high7.5 | Exploit | ||
A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service att… | ||||
| CVE-2022-37603US | high7.5 | — | ||
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateNam… | ||||
| CVE-2022-3171US | high7.5 | — | ||
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multip… | ||||
| CVE-2022-37601US | critical9.8 | — | ||
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 a… | ||||
| CVE-2022-37599US | high7.5 | — | ||
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in inter… | ||||
| CVE-2021-23446US | high7.5 | — | ||
The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNu… | ||||
| CVE-2015-5237US | high8.8 | — | ||
protobuf allows remote authenticated attackers to cause a heap-based buffer overflow. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Splunk Security Advisory SVD-2024-0101 vom 2024-01-09external
- Splunk Security Advisory SVD-2024-0102 vom 2024-01-09external
- Splunk Security Advisory SVD-2024-0103 vom 2024-01-09external
- Splunk Security Advisory SVD-2024-0104 vom 2024-01-09external
- Splunk Security Advisory SVD-2024-0112 vom 2024-01-30external
- Splunk Security Advisory SVD-2024-0718 vom 2024-07-02external
- Atlassian Security Bulletin - November 18 2025external
- WID-SEC-W-2024-0049 - CSAF Versionself
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan