CVE Vulnerability Catalog

A vulnerability in chenhg5 cc-connect up to 1.4.1 in the shellExecCommand function of core/engine.go in the Management API allows remote OS command injection via the exec argument. The exploit is publicly available.

A vulnerability in chenhg5 cc-connect up to 1.4.1 in the Authenticate function of core/webhook.go allows remote code injection via the exec argument. The exploit is publicly available.

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects parameter is set to false. A non-admin user with the reader role can list alarms from all projects, exposing sensitive data. Additionally, OpenStack Watcher does not enforce authorization on its webhook trigger endpoint, allowing authenticated users to start EVENT audits.

PythonTools in Agno (libs/agno/agno/tools/python.py) contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the file_name argument to read_file, save_to_file, or run_python_file actions. The attack can be performed via direct tool invocation or via prompt injection in agent-processed content.

In TRENDnet TEW-755AP up to 20260702, the log_email_server function in /cgi-bin/email.cgi of the ssi component is vulnerable to command injection. The attack can be performed remotely, and the exploit is publicly available.

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with HTTP Event Collector in Splunk Enterprise. The vulnerability exists because the Kerberos authentication path does not apply the configured certificate validation options when building the HTTP client.

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect REST API could configure a non-secure HTTP Event Collector endpoint in Splunk Enterprise, causing the connector to send authentication credentials to an attacker-controlled server. This could lead to credential exposure and compromise of data sent through the connector.

In Splunk AI Toolkit versions below 6.0.1, a user with the "power" role could modify app-provided scheduled searches to run arbitrary SPL using the permissions of the search owner. This could allow access to all relevant data and affect system integrity.

In Splunk AI Toolkit versions below 6.0.0, a user with the "power" role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is due to not preserving the trusted experiment scope when processing caller-controlled query values.

In Splunk AI Toolkit versions below 6.0.0, a user with a role having the schedule_search capability could cause a scheduled search to load and deserialize a model file through the apply search command. The vulnerability is due to the apply search command not being marked as risky.

In Splunk AI Toolkit versions below 6.0.0, a user with the "power" role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The vulnerability is due to deserialization of untrusted data without guarding against embedded pickle content.

In Splunk AI Toolkit versions below 6.0.0, a low-privileged user without "admin" or "power" roles could start, stop, and configure containers, and read or modify connection and configuration data through the REST API. The vulnerability is due to missing authorization checks in multiple REST API handlers.

In Splunk AI Toolkit versions below 6.0.0, a user without "admin" or "power" roles could run searches with system-level privileges, access all relevant data, affect system integrity, and read or delete search jobs belonging to other users through Agent Run History. The vulnerability is due to replacing the calling user session key with a system authentication token before performing search operations.

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user with the get_talos_enrichment capability could send a crafted request to the Talos intelligence enrichment REST API endpoint and cause the instance to make an outbound request to an attacker-controlled server. The request could expose tokens that compromise all relevant data and system integrity in the Splunk instance.

In Splunk Enterprise Security versions below 8.6.1, a user with the ess_analyst role could change UEBA search macros that scheduled searches run with administrator permissions, allowing for access to all relevant data and system integrity through those searches. The vulnerability is due to granting analyst roles write access to search macros that should be writable only by administrator roles.

In Splunk Enterprise Security versions below 8.6.1, a user with a role containing the mc_investigation_read capability could inject SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity available to the scheduled searches that run for that user. The vulnerability is due to lack of validation of filter field names before they are included in SPL searches.

In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk REST server could access or modify all relevant data exchanged through that credential manager. The vulnerability exists because the CyberArk REST client does not verify server certificates by default. The attack requires network-path interception capability between Splunk SOAR and the CyberArk REST server.

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the REST API and execute arbitrary code. The vulnerability exists because the REST API does not require an assigned role for the request and does not restrict the user-supplied file path to the intended temporary directory.

In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability exists because the Splunk SOAR Automation Broker trusts a client-supplied source IP address header as proof that the request originates from the local system. Successful exploitation can expose all relevant data, affect system integrity, and disrupt service availability.

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a REST API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prior to 10.4. The vulnerability exists because the Edge Processor service endpoint lacks authentication controls.