CVE-2013-6771

Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the file parameter. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2013-7394 is for the issue in the "runshellscript echo.sh" script.

• CWE-22

• http://www.splunk.com/view/SP-CAAAH76Vendor Advisory
• http://zerodayinitiative.com/advisories/ZDI-14-052/
• http://www.splunk.com/view/SP-CAAAH76Vendor Advisory
• http://zerodayinitiative.com/advisories/ZDI-14-052/

Published

Aug 7, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-6765OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows…
• CVE-2013-6766OpenVAS Administrator 1.2 before 1.2.2 and 1.3 before 1.3.2 …
• CVE-2013-6767Stack-based buffer overflow in pepoly.dll in Quick Heal Anti…
• CVE-2013-6768Untrusted search path vulnerability in the CyanogenMod/Clock…
• CVE-2013-6769The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1…
• CVE-2013-6770The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1…
• CVE-2013-6772Splunk before 5.0.4 lacks X-Frame-Options which can allow Cl…4.3
• CVE-2013-6773Splunk 5.0.3 has an Unquoted Service Path in Windows for Uni…7.8
• CVE-2013-6774Untrusted search path vulnerability in the ChainsDD Superuse…
• CVE-2013-6775The Chainfire SuperSU package before 1.69 for Android allows…
• CVE-2013-6780Cross-site scripting (XSS) vulnerability in uploader.swf in …
• CVE-2013-6785Directory traversal vulnerability in url_redirect.cgi in Sup…4.3