Alex Hordijk (hordalex)

Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk Enterprise

Improper Authorization through the REST API in Splunk Enterprise

Denial of Service through coldToFrozen.sh Script in Splunk Enterprise

Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

Sensitive Information Disclosure through Improper Access Control in Splunk Enterprise

Remote Code Execution through file upload to “$SPLUNK_HOME/var/run/splunk/apptemp“ directory in Splunk Enterprise

Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk