Anton (therceman)

Low-privileged User can View Hashed Default Splunk Password

Information Disclosure via the ‘copyresults’ SPL Command

Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app

Cross-Site Request Forgery in the ‘ssg/kvstore_client’ REST Endpoint in Splunk Enterprise

Denial of Service (DoS) on the datamodel/web REST endpoint

Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard

Information Disclosure in Mobile Alert Responses in Splunk Secure Gateway

Persistent Cross-site Scripting (XSS) in Web Bulletin

Risky commands warnings in Splunk Enterprise Dashboards