[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feiRNXDtp0KcvcZuD_CxvPHIz5PrtLlK4RyK5Xjc-3gY":3,"g5a-ex:splunk\u002Funiversal_forwarder@*":241,"g5a-family:splunk\u002Funiversal_forwarder":243},{"success":4,"data":5},true,{"product":6,"versions":111,"topVulnerabilitiesByEpss":159,"kevVulnerabilities":218,"seoMetadata":219,"meta":238},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":110},"splunk","universal_forwarder",47,61,0,"2025-06-02",[14,17,19,21,23,25,27,29,31,33,35,37,39,41,43,45,47,49,51,53,55,57,60,62,64,66,68,70,72,74,76,78,80,82,84,86,88,90,92,94,96,98,100,102,104,106,108],{"version":15,"cve_count":11,"kev_count":11,"has_kev":16},"4.2.3.105575",false,{"version":18,"cve_count":11,"kev_count":11,"has_kev":16},"4.2.4.110225",{"version":20,"cve_count":11,"kev_count":11,"has_kev":16},"8.2.0",{"version":22,"cve_count":11,"kev_count":11,"has_kev":16},"8.2.10",{"version":24,"cve_count":11,"kev_count":11,"has_kev":16},"8.2.11",{"version":26,"cve_count":11,"kev_count":11,"has_kev":16},"8.2.12",{"version":28,"cve_count":11,"kev_count":11,"has_kev":16},"8.2.6",{"version":30,"cve_count":11,"kev_count":11,"has_kev":16},"8.2.7",{"version":32,"cve_count":11,"kev_count":11,"has_kev":16},"8.2.8",{"version":34,"cve_count":11,"kev_count":11,"has_kev":16},"8.2.9",{"version":36,"cve_count":11,"kev_count":11,"has_kev":16},"9.0.0",{"version":38,"cve_count":11,"kev_count":11,"has_kev":16},"9.0.1",{"version":40,"cve_count":11,"kev_count":11,"has_kev":16},"9.0.10",{"version":42,"cve_count":11,"kev_count":11,"has_kev":16},"9.0.2",{"version":44,"cve_count":11,"kev_count":11,"has_kev":16},"9.0.3",{"version":46,"cve_count":11,"kev_count":11,"has_kev":16},"9.0.4",{"version":48,"cve_count":11,"kev_count":11,"has_kev":16},"9.0.5",{"version":50,"cve_count":11,"kev_count":11,"has_kev":16},"9.0.6",{"version":52,"cve_count":11,"kev_count":11,"has_kev":16},"9.0.7",{"version":54,"cve_count":11,"kev_count":11,"has_kev":16},"9.0.8",{"version":56,"cve_count":11,"kev_count":11,"has_kev":16},"9.0.9",{"version":58,"cve_count":59,"kev_count":11,"has_kev":16},"9.1.0",58,{"version":61,"cve_count":11,"kev_count":11,"has_kev":16},"9.1.1",{"version":63,"cve_count":11,"kev_count":11,"has_kev":16},"9.1.2",{"version":65,"cve_count":11,"kev_count":11,"has_kev":16},"9.1.3",{"version":67,"cve_count":11,"kev_count":11,"has_kev":16},"9.1.4",{"version":69,"cve_count":11,"kev_count":11,"has_kev":16},"9.1.5",{"version":71,"cve_count":11,"kev_count":11,"has_kev":16},"9.1.6",{"version":73,"cve_count":11,"kev_count":11,"has_kev":16},"9.1.7",{"version":75,"cve_count":11,"kev_count":11,"has_kev":16},"9.1.8",{"version":77,"cve_count":11,"kev_count":11,"has_kev":16},"9.1.9",{"version":79,"cve_count":11,"kev_count":11,"has_kev":16},"9.2.0",{"version":81,"cve_count":11,"kev_count":11,"has_kev":16},"9.2.0.1",{"version":83,"cve_count":11,"kev_count":11,"has_kev":16},"9.2.1",{"version":85,"cve_count":11,"kev_count":11,"has_kev":16},"9.2.2",{"version":87,"cve_count":11,"kev_count":11,"has_kev":16},"9.2.3",{"version":89,"cve_count":11,"kev_count":11,"has_kev":16},"9.2.4",{"version":91,"cve_count":11,"kev_count":11,"has_kev":16},"9.2.5",{"version":93,"cve_count":11,"kev_count":11,"has_kev":16},"9.2.6",{"version":95,"cve_count":11,"kev_count":11,"has_kev":16},"9.3.0",{"version":97,"cve_count":11,"kev_count":11,"has_kev":16},"9.3.1",{"version":99,"cve_count":11,"kev_count":11,"has_kev":16},"9.3.2",{"version":101,"cve_count":11,"kev_count":11,"has_kev":16},"9.3.3",{"version":103,"cve_count":11,"kev_count":11,"has_kev":16},"9.3.4",{"version":105,"cve_count":11,"kev_count":11,"has_kev":16},"9.4.0",{"version":107,"cve_count":11,"kev_count":11,"has_kev":16},"9.4.1",{"version":109,"cve_count":11,"kev_count":11,"has_kev":16},"9.4.2","Universal Forwarder by Splunk is a technology product with 47 tracked versions and 61 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158],{"version":15,"cve_count":11,"kev_count":11,"has_kev":16},{"version":18,"cve_count":11,"kev_count":11,"has_kev":16},{"version":20,"cve_count":11,"kev_count":11,"has_kev":16},{"version":22,"cve_count":11,"kev_count":11,"has_kev":16},{"version":24,"cve_count":11,"kev_count":11,"has_kev":16},{"version":26,"cve_count":11,"kev_count":11,"has_kev":16},{"version":28,"cve_count":11,"kev_count":11,"has_kev":16},{"version":30,"cve_count":11,"kev_count":11,"has_kev":16},{"version":32,"cve_count":11,"kev_count":11,"has_kev":16},{"version":34,"cve_count":11,"kev_count":11,"has_kev":16},{"version":36,"cve_count":11,"kev_count":11,"has_kev":16},{"version":38,"cve_count":11,"kev_count":11,"has_kev":16},{"version":40,"cve_count":11,"kev_count":11,"has_kev":16},{"version":42,"cve_count":11,"kev_count":11,"has_kev":16},{"version":44,"cve_count":11,"kev_count":11,"has_kev":16},{"version":46,"cve_count":11,"kev_count":11,"has_kev":16},{"version":48,"cve_count":11,"kev_count":11,"has_kev":16},{"version":50,"cve_count":11,"kev_count":11,"has_kev":16},{"version":52,"cve_count":11,"kev_count":11,"has_kev":16},{"version":54,"cve_count":11,"kev_count":11,"has_kev":16},{"version":56,"cve_count":11,"kev_count":11,"has_kev":16},{"version":58,"cve_count":59,"kev_count":11,"has_kev":16},{"version":61,"cve_count":11,"kev_count":11,"has_kev":16},{"version":63,"cve_count":11,"kev_count":11,"has_kev":16},{"version":65,"cve_count":11,"kev_count":11,"has_kev":16},{"version":67,"cve_count":11,"kev_count":11,"has_kev":16},{"version":69,"cve_count":11,"kev_count":11,"has_kev":16},{"version":71,"cve_count":11,"kev_count":11,"has_kev":16},{"version":73,"cve_count":11,"kev_count":11,"has_kev":16},{"version":75,"cve_count":11,"kev_count":11,"has_kev":16},{"version":77,"cve_count":11,"kev_count":11,"has_kev":16},{"version":79,"cve_count":11,"kev_count":11,"has_kev":16},{"version":81,"cve_count":11,"kev_count":11,"has_kev":16},{"version":83,"cve_count":11,"kev_count":11,"has_kev":16},{"version":85,"cve_count":11,"kev_count":11,"has_kev":16},{"version":87,"cve_count":11,"kev_count":11,"has_kev":16},{"version":89,"cve_count":11,"kev_count":11,"has_kev":16},{"version":91,"cve_count":11,"kev_count":11,"has_kev":16},{"version":93,"cve_count":11,"kev_count":11,"has_kev":16},{"version":95,"cve_count":11,"kev_count":11,"has_kev":16},{"version":97,"cve_count":11,"kev_count":11,"has_kev":16},{"version":99,"cve_count":11,"kev_count":11,"has_kev":16},{"version":101,"cve_count":11,"kev_count":11,"has_kev":16},{"version":103,"cve_count":11,"kev_count":11,"has_kev":16},{"version":105,"cve_count":11,"kev_count":11,"has_kev":16},{"version":107,"cve_count":11,"kev_count":11,"has_kev":16},{"version":109,"cve_count":11,"kev_count":11,"has_kev":16},[160,168,175,180,186,192,197,202,208,213],{"cveId":161,"description":162,"publishedDate":163,"cvssScore":164,"cvssVersion":165,"severity":166,"isKev":16,"epssScore":167},"CVE-2021-22901","curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP\u002F1.1 connection or multiplexed HTTP\u002F2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.","2021-06-11",8.1,"v3.1","High",0.63531,{"cveId":169,"description":170,"publishedDate":171,"cvssScore":172,"cvssVersion":165,"severity":173,"isKev":16,"epssScore":174},"CVE-2022-32206","curl \u003C 7.84.0 supports \"chained\" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable \"links\" in this \"decompression chain\" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a \"malloc bomb\", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.","2022-07-07",6.5,"Medium",0.36348,{"cveId":176,"description":177,"publishedDate":171,"cvssScore":178,"cvssVersion":165,"severity":173,"isKev":16,"epssScore":179},"CVE-2022-32205","A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl \u003C 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a \"sister server\" to effectively cause a denial of service for a sibling site on the same second level domain using this method.",4.3,0.31497,{"cveId":181,"description":182,"publishedDate":183,"cvssScore":184,"cvssVersion":165,"severity":166,"isKev":16,"epssScore":185},"CVE-2022-35737","SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.","2022-08-03",7.5,0.23251,{"cveId":187,"description":188,"publishedDate":189,"cvssScore":190,"cvssVersion":165,"severity":166,"isKev":16,"epssScore":191},"CVE-2021-30560","Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","2021-08-03",8.8,0.17634,{"cveId":193,"description":194,"publishedDate":195,"cvssScore":184,"cvssVersion":165,"severity":166,"isKev":16,"epssScore":196},"CVE-2022-43551","A vulnerability exists in curl \u003C7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.","2022-12-23",0.16598,{"cveId":198,"description":199,"publishedDate":200,"cvssScore":184,"cvssVersion":165,"severity":166,"isKev":16,"epssScore":201},"CVE-2021-22926","libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `\u002Ftmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.","2021-08-05",0.1514,{"cveId":203,"description":204,"publishedDate":171,"cvssScore":205,"cvssVersion":165,"severity":206,"isKev":16,"epssScore":207},"CVE-2022-32207","When curl \u003C 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.",9.8,"Critical",0.12321,{"cveId":209,"description":210,"publishedDate":211,"cvssScore":184,"cvssVersion":165,"severity":166,"isKev":16,"epssScore":212},"CVE-2020-8285","curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.","2020-12-14",0.0977,{"cveId":214,"description":215,"publishedDate":171,"cvssScore":216,"cvssVersion":165,"severity":173,"isKev":16,"epssScore":217},"CVE-2022-32208","When curl \u003C 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.",5.9,0.08373,[],{"title":220,"metaDescription":221,"keywords":222,"structuredData":223},"Universal Forwarder by Splunk - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Universal Forwarder by Splunk covering 47 versions with 61 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Universal Forwarder vulnerabilities, Universal Forwarder security, Universal Forwarder CVE, Splunk Universal Forwarder, Universal Forwarder threat intelligence, Splunk security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":224,"@type":225,"name":226,"description":221,"url":227,"manufacturer":228,"applicationCategory":232,"softwareVersion":233,"mainEntity":234},"https:\u002F\u002Fschema.org","SoftwareApplication","Universal Forwarder","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fsplunk\u002Funiversal_forwarder",{"@type":229,"name":230,"url":231},"Organization","Splunk","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fsplunk","Security Software","47 versions tracked",{"@type":235,"name":236,"description":237,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Universal Forwarder Security Vulnerabilities","Security vulnerabilities affecting Universal Forwarder by Splunk",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":239,"apiVersion":240},"2026-10-17T00:10:46.101Z","3.0",{"rows":242,"total":11,"capped":16,"failed":11},[],[]]