Skip to content
Threat Feed
Subscribe

Tag

Log-Analysis

2 briefs RSS
low advisory

Detection of Web Server Reconnaissance via Error Log Spikes

This brief covers the detection of automated reconnaissance activities, such as vulnerability scanning and fuzzing, which manifest as significant spikes in web server error logs.

HTTP Server +2 reconnaissance web-security log-analysis
1r 3t
high advisory

Splunk Authentication Token Exposure in Debug Logs (CVE-2024-29945)

A critical vulnerability, CVE-2024-29945, allows for the exposure of authentication tokens in debug logs within Splunk Enterprise and Splunk Cloud, enabling an attacker with access to internal log files to gain unauthorized access, exfiltrate data, and potentially achieve full compromise of the Splunk infrastructure if unpatched versions (prior to 9.2.1, 9.1.4, and 9.0.9 for Enterprise) are in use.

Splunk Enterprise +3 splunk vulnerability token-exposure log-analysis application
1r 1t 1c