Anton (therceman)

Sensitive Information Disclosure in Splunk Secure Gateway App

Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise

Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app

URL validation bypass through Views Dashboard in Splunk Enterprise

Risky command safeguards bypass using the “/services/streams/search“ REST endpoint through “q“ parameter in Splunk Enterprise

Improper Access Control Lets Low-Privilege Users Suppress Read-Only Alerts in Splunk Enterprise

Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise

Missing Access Control of Saved Searches in the Splunk Archiver app

Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk Enterprise

Sensitive Information Disclosure of Index Metrics through “mrollup” SPL Command