Filtered by vendor Solarwinds
Subscribe
Total
253 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2006-1951 | 1 Solarwinds | 1 Tftp Server | 2018-10-18 | 5.0 MEDIUM | N/A |
| Directory traversal vulnerability in SolarWinds TFTP Server 8.1 and earlier allows remote attackers to download arbitrary files via a crafted GET request including "....//" sequences, which are collapsed into "../" sequences by filtering. | |||||
| CVE-2010-4828 | 1 Solarwinds | 1 Orion Network Performance Monitor | 2018-10-10 | 4.3 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) 10.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Title parameter to MapView.aspx; NetObject parameter to (2) NodeDetails.aspx and (3) InterfaceDetails.aspx; and the (4) ChartName parameter to CustomChart.aspx. | |||||
| CVE-2017-9538 | 1 Solarwinds | 1 Network Performance Monitor | 2018-10-09 | 4.0 MEDIUM | 4.9 MEDIUM |
| The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cause a denial of service (permanent display of a "Cannot exit above the top directory" error message throughout the entire web application) via a ".." in the path field. In other words, the denial of service is caused by an incorrect implementation of a directory-traversal protection mechanism. | |||||
| CVE-2017-9537 | 1 Solarwinds | 1 Network Performance Monitor | 2018-10-09 | 3.5 LOW | 4.8 MEDIUM |
| Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to introduce arbitrary JavaScript into various vulnerable parameters. | |||||
| CVE-2018-10240 | 1 Solarwinds | 1 Serv-u | 2018-06-25 | 5.0 MEDIUM | 7.3 HIGH |
| SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. This session token's value can be brute-forced by an attacker to obtain the corresponding session cookie and hijack the user's session. | |||||
| CVE-2018-10241 | 1 Solarwinds | 1 Serv-u | 2018-06-20 | 4.0 MEDIUM | 6.5 MEDIUM |
| A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the application (with a NULL pointer dereference) via a specially crafted URL beginning with the /Web%20Client/ substring. | |||||
| CVE-2012-2576 | 1 Solarwinds | 3 Backup Profiler, Storage Manager, Storage Profiler | 2018-01-11 | 10.0 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backup Profiler before 5.1.2 allows remote attackers to execute arbitrary SQL commands via the loginName field. | |||||
| CVE-2009-3115 | 1 Solarwinds | 1 Tftp Server | 2017-09-19 | 5.0 MEDIUM | N/A |
| SolarWinds TFTP Server 9.2.0.111 and earlier allows remote attackers to cause a denial of service (service stop) via a crafted Option Acknowledgement (OACK) request. NOTE: some of these details are obtained from third party information. | |||||
| CVE-2012-2577 | 1 Solarwinds | 1 Orion Network Performance Monitor | 2017-08-29 | 4.3 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName field of an snmpd.conf file. | |||||
| CVE-2010-2310 | 1 Solarwinds | 1 Tftp Server | 2017-08-17 | 5.0 MEDIUM | N/A |
| SolarWinds TFTP Server 10.4.0.13 allows remote attackers to cause a denial of service (crash) via a long write request. | |||||
| CVE-2002-1209 | 1 Solarwinds | 1 Tftp Server | 2017-07-11 | 5.0 MEDIUM | N/A |
| Directory traversal vulnerability in SolarWinds TFTP Server 5.0.55, and possibly earlier, allows remote attackers to read arbitrary files via "..\" (dot-dot backslash) sequences in a GET request. | |||||
| CVE-2017-7722 | 1 Solarwinds | 1 Log \& Event Manager | 2017-04-21 | 10.0 HIGH | 10.0 CRITICAL |
| In SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4, a menu system is encountered when the SSH service is accessed with "cmc" and "password" (the default username and password). By exploiting a vulnerability in the restrictssh feature of the menuing script, an attacker can escape from the restricted shell. | |||||
| CVE-2017-7646 | 1 Solarwinds | 1 Log \& Event Manager | 2017-04-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to browse the server's filesystem and read the contents of arbitrary files contained within. | |||||
| CVE-2017-6803 | 1 Solarwinds | 1 Ftp Voyager | 2017-03-23 | 6.8 MEDIUM | 8.8 HIGH |
| Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds (formerly Serv-U) FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that (1) change the admin password, (2) terminate the scheduler, or (3) possibly execute arbitrary commands via crafted requests to Admin/XML/Result.xml. | |||||
| CVE-2016-3643 | 1 Solarwinds | 1 Virtualization Manager | 2016-12-06 | 7.2 HIGH | 7.8 HIGH |
| SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd." | |||||
| CVE-2015-7840 | 1 Solarwinds | 1 Log And Event Manager | 2016-12-03 | 7.5 HIGH | N/A |
| The command line management console (CMC) in SolarWinds Log and Event Manager (LEM) before 6.2.0 allows remote attackers to execute arbitrary code via unspecified vectors involving the ping feature. | |||||
| CVE-2016-5709 | 1 Solarwinds | 1 Virtualization Manager | 2016-11-30 | 1.9 LOW | 4.7 MEDIUM |
| SolarWinds Virtualization Manager 6.3.1 and earlier uses weak encryption to store passwords in /etc/shadow, which allows local users with superuser privileges to obtain user passwords via a brute force attack. | |||||
| CVE-2015-5610 | 1 Solarwinds | 1 N-able N-central | 2016-11-28 | 4.0 MEDIUM | N/A |
| The RSM (aka RSMWinService) service in SolarWinds N-Able N-Central before 9.5.1.4514 uses the same password decryption key across different customers' installations, which makes it easier for remote authenticated users to obtain the cleartext domain-administrator password by locating the encrypted password within HTML source code and then leveraging knowledge of this key from another installation. | |||||
| CVE-2015-5371 | 1 Solarwinds | 1 Storage Manager | 2016-11-28 | 10.0 HIGH | N/A |
| The AuthenticationFilter class in SolarWinds Storage Manager allows remote attackers to upload and execute arbitrary scripts via unspecified vectors. | |||||
| CVE-2016-3642 | 1 Solarwinds | 1 Virtualization Manager | 2016-06-20 | 10.0 HIGH | 9.8 CRITICAL |
| The RMI service in SolarWinds Virtualization Manager 6.3.1 and earlier allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. | |||||