universal forwarder · threatengine.sh

Home/Product/splunk universal forwarder

Product

splunk universal forwarder

61 known vulnerabilities across versions

Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.

Sort Min CVSS Published since

>= 9.1.0 and < 9.1.9

In Universal Forwarder for Windows versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9, a new installation of or an upgrade to an affect

>= 8.2.0 and < 8.2.12

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection d

>= 8.2.0 and < 8.2.12

A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduce

>= 8.2.0 and < 8.2.12

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously establishe

>= 8.2.0 and < 8.2.12

An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong crede

>= 8.2.0 and < 8.2.12

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced whe

>= 8.2.0 and < 8.2.12

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pa

>= 8.2.0 and < 8.2.12

An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compress

>= 8.2.0 and < 8.2.12

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to beh

>= 8.2.0 and < 8.2.12

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail w

>= 8.2.0 and < 8.2.12

A use after free vulnerability exists in curl <7.87.0. Curl can be asked to tunnel virtually all protocols it supports through a

>= 8.2.0 and < 8.2.12

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, c

>= 8.2.0 and < 8.2.12

curl can be told to parse a .netrc file for credentials. If that file endsin a line with 4095 consecutive non-white space letter

>= 8.2.0 and < 8.2.12

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, ev

>= 8.2.0 and < 8.2.12

In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL poi

>= 8.2.0 and < 8.2.12

curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the c

>= 8.2.0 and < 8.2.12

In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be in

>= 8.2.0 and < 8.2.12

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are s

>= 8.2.0 and < 8.2.12

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and

>= 8.1.0 and < 8.1.11

In Splunk Enterprise and Universal Forwarder versions in the following table, indexing a specially crafted ZIP file using the file

>= 8.2.0 and < 8.2.12

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string arg

>= 8.2.0 and < 8.2.12

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possib

>= 8.2.0 and < 8.2.12

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation

>= 8.2.0 and < 8.2.12

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and p

>= 8.2.0 and < 8.2.12

A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and curl < 7.84.0 stores all of

In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface (CLI) did not validate TLS cer

>= 8.2.0 and < 8.2.12

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HT

>= 8.2.0 and < 8.2.12

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibi

>= 8.2.0 and < 8.2.12

libcurl provides the CURLOPT_CERTINFO option to allow applications torequest details to be returned about a server's certificate

>= 8.2.0 and < 8.2.12

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a

>= 8.2.0 and < 8.2.12

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be

>= 8.2.0 and < 8.2.12

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when --no-clobber is used together

>= 8.2.0 and < 8.2.12

A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HT

>= 8.2.0 and < 8.2.12

An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in t

>= 8.2.0 and < 8.2.12

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow

>= 8.2.0 and < 8.2.12

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticate

>= 8.2.0 and < 8.2.12

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, t

>= 8.2.0 and < 8.2.12

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (

>= 8.2.0 and < 8.2.12

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an alr

>= 8.2.0 and < 8.2.12

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLC

>= 8.2.0 and < 8.2.12

curl supports the -t command line option, known as CURLOPT_TELNETOPTIONSin libcurl. This rarely used option is used to send va

>= 8.2.0 and < 8.2.12

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.

>= 8.2.0 and < 8.2.12

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink

>= 8.2.0 and < 8.2.12

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the met

>= 8.2.0 and < 8.2.12

Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corrupt

>= 8.2.0 and < 8.2.12

libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).

>= 8.2.0 and < 8.2.12

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3

>= 8.2.0 and < 8.2.12

curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS

>= 8.2.0 and < 8.2.12

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIP

>= 8.2.0 and < 8.2.12

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer

>= 8.2.0 and < 8.2.12

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad han

>= 8.2.0 and < 8.2.12

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leak

>= 8.2.0 and < 8.2.12

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the O

>= 8.2.0 and < 8.2.12

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match pa

>= 8.2.0 and < 8.2.12

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and p

>= 8.2.0 and < 8.2.12

Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.

>= 8.2.0 and < 8.2.12

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwrit

>= 8.2.0 and < 8.2.12

curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leak

>= 8.2.0 and < 8.2.12

libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

>= 8.2.0 and < 8.2.12

libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed qu

>= 8.2.0 and < 8.2.12

An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin