Chris Green at Splunk

Splunk Enterprise lacked TLS cert validation for Splunk-to-Splunk communication by default

Universal Forwarder management services allows remote login by default

Risky commands warnings in Splunk Enterprise Dashboards

Splunk Enterprise disabled TLS validation using the CA certificate stores in Python 3 libraries by default

Splunk Enterprise lacked TLS host name validation

Splunk Enterprise and Universal Forwarder CLI connections lacked TLS cert validation