Danylo Dmytriiev (DDV_UA)

Remote Code Execution via Serialized Session Payload

Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpoint

Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows

Denial of Service (DoS) via the ‘printf’ Search Function

Denial of Service via the 'dump' SPL command

Persistent Cross-Site Scripting through the ‘module’ Tag in a View in Splunk Enterprise

Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway app

Command Injection in Splunk Enterprise Using External Lookups

Risky commands warnings in Splunk Enterprise Dashboards

Reflected XSS in a query parameter of the Monitoring Console