Danylo Dmytriiev (DDV_UA)

Stored Cross-Site Scripting (XSS) through Path Traversal in Splunk Enterprise

Reflected Cross-site Scripting (XSS) in '/app/search/table' endpoint through the 'dataset.command' parameter on Splunk Enterprise

Stored Cross-Site Scripting (XSS) through missing field warning messages in Saved Search and Job Inspector on Splunk Enterprise

Denial of Service (DoS) through “User Interface - Views“ configuration page in Splunk Enterprise

Absolute Path Traversal in Splunk Enterprise Using runshellscript.py

Deserialization of Untrusted Data on Splunk Enterprise for Windows through Path Traversal from Separate Disk Partition

Remote Code Execution via the Splunk Secure Gateway application Mobile Alerts feature

XML External Entity Injection through a custom View in Splunk Enterprise

Remote Code Execution through dashboard PDF generation component in Splunk Enterprise

Reflected Cross-Site Scripting via the radio template in Splunk Enterprise