Gabriel Nitu, Splunk

Improper Access Control through Scheduled Searches in Splunk AI Toolkit

Denial of Service (DoS) through the REST API in Splunk Connect for Kafka

Regular Expression Denial of Service (DoS) through the REST API in Splunk Connect for Kafka

Server-Side Request Forgery (SSRF) through the REST API in Splunk Connect for Kafka

Information Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) app

Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for Enterprise Security Cloud

Insecure Default Domain Allowlist in Splunk AI Toolkit

OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit

Improper Handling and Insufficient Isolation of Specific Temporary Files in Splunk Enterprise

Privilege escalation for users who hold the “splunk_app_soar“ role in the Splunk App for SOAR