All CVEs — page 259 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The AsyncHttpClient library incorrectly handles HTTP proxy connections by inferring tunnel existence from the last request method instead of the CONNECT result. This allows attackers to send authentication credentials over plaintext proxy connections even when the proxy rejects the CONNECT request, potentially exposing sensitive credentials.
Vault fails to verify that plugin catalog entries reference binaries within the configured plugin directory, allowing a privileged operator with snapshot restoration access to potentially execute arbitrary code on the Vault host through a Shamir seal restore operation.
Splunk failed to properly adhere to coding standards, leading to critical vulnerabilities that can result in full system compromise through high-impact code execution or data exposure.
Splunk Enterprise suffers from improper neutralization of input data, allowing attackers to inject malicious content that can lead to high-impact consequences including data exposure, modification, and system compromise. This vulnerability affects multiple versions of Splunk Enterprise and represents a critical security flaw.
Splunk's protection mechanisms failed, allowing attackers with limited privileges to escalate their access and potentially compromise sensitive data. This vulnerability affects multiple Splunk Enterprise versions and represents a failure in access control enforcement.