CVE Vulnerability Catalog

In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use those tokens to compromise all relevant data and system integrity available to the user account running Splunk Enterprise. The vulnerability is possible because the Windows management-port listener does not apply exclusive address binding protections before the service starts.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary SPL pipelines from Dataset Explorer with the same privileges as that user. This is possible because Dataset Explorer does not validate or escape dataset names before building SPL searches and does not apply SPL safeguards for risky commands. The attack requires phishing the user into opening a crafted link.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user with the schedule_search capability could run arbitrary SPL commands with the highest system privilege and read every credential stored in the credential store. This is possible because scheduled search alert action configuration does not properly restrict user-specific alert action settings before the search scheduler runs alert actions.

In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user without the admin or power roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the stored access token. This is possible because the app's REST API endpoint handlers do not enforce the read_o11y_content capability before forwarding requests. The vulnerability does not affect versions 9.4 and 9.3.

IBM System Storage DS8A00 versions 10.1.3.0 through 10.11.35.0 and IBM DS8900F versions 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged roles due to improper privileged defined with unsafe actions.

IBM System Storage DS8A00 versions 10.1.3.0 through 10.11.35.0 and IBM DS8900F versions 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improper encoding of DSCLI command output, potentially obtaining sensitive information or causing a denial of service.

In TRENDnet TV-IP751WIC version 11.03.03, a command injection vulnerability exists in the file /cgi-bin/admin/set_time.cgi of the alphapd component. Manipulation leads to command injection. The attack can be initiated remotely, and the exploit is publicly available.

In TRENDnet TEW-821DAP version 2.2.01b05, a command injection vulnerability exists in the popen/system function of the file /cgi-bin/ping.cgi in the ssi component. Manipulating the ipaddr argument can lead to command injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

A flaw was found in acm-operator-bundle. The build process downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.

In Netty prior to 4.1.137.Final and 4.2.17.Final, the default SniHandler constructors use the pre-handshake ClientHello aggregation path, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients.

The build process of mce-operator-bundle fetches and executes scripts from a remote repository without integrity checks, such as commit pinning or signature verification. A malicious actor with write access to the repository can inject and execute arbitrary code during the build. This compromises the build process and may lead to distribution of malicious software.

In LiquidJS before 10.27.2, the join filter in src/filters/array.ts computes complexity from array length and separator length instead of the total string length. The concat filter can cheaply double arrays, and join then materializes content while charging only for element count, allowing a template to exceed memoryLimit. The array_to_sentence_string filter has a similar defect, potentially crashing the process.

In Coturn before 4.13.0, an authenticated TURN user can place printf-style format specifiers in STUN USERNAME or REALM attributes, which pass is_secure_string() validation and are embedded into Redis keys. send_message_to_redis() passes the attacker-controlled key as the format argument to redisAsyncCommand(), causing reads past the va_list. Exploitation can crash the coturn process or disclose stack memory into Redis.

A race condition in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

In LiquidJS from 10.26.0 to 10.27.1, the strip_html filter can enter an infinite loop when the input contains '<', has at least one preceding character, and no later '>'. This blocks template rendering and can cause denial of service with input as short as 'a<'.

In Koel before 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without SafeUrl and HasAudioContentType checks. The stored URL is passed to RadioStreamProxy::openStream(), which calls fopen($url, 'r', false, $context). This allows access to internal HTTP services such as loopback, RFC1918, Docker bridge, or metadata.

In Koel before 9.7.1, outbound podcast and radio fetch paths perform a point-in-time isPublicHost() or isSafeUrl() check without pinning the validated address, and most paths lack redirect-hop validation. This allows following an attacker-controlled redirect to an internal address or connecting after DNS rebinding. These paths are reachable through podcast and radio APIs, allowing an authenticated user to access internal services or cloud metadata.

In Termix before 2.3.2, the POST /host/db/proxy/test endpoint accepts singleProxy, proxyChain, and testTarget fields without validating destination addresses. The testProxyConnectivity path uses raw TCP and SOCKS connections to attacker-selected hosts and ports, allowing an authenticated user to probe localhost, private networks, link-local metadata services, and other infrastructure. Connection errors disclose host reachability, and metadata access can expose cloud credentials.

In Termix before 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table contains password-reset artifacts, allowing a low-privileged authenticated user to recover another account's reset code and complete the password-reset flow. Successful exploitation results in local-user account takeover and administrative compromise when the victim is an administrator.

In Termix before 2.3.2, the archive creation endpoint passes selected file basenames to tar without an end-of-options marker and without making operands unambiguously relative. A user can select basenames beginning with GNU tar options such as --checkpoint=1 and --checkpoint-action=exec, causing tar to interpret them as options. The resulting checkpoint action executes commands on the managed SSH host with the privileges of the connected SSH account, allowing file disclosure, modification, and service disruption.