Filtered by vendor Solarwinds
Subscribe
Total
253 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-35228 | 1 Solarwinds | 1 Database Performance Analyzer | 2021-10-26 | 2.6 LOW | 4.7 MEDIUM |
| This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attack in order to change header for a remote victim. | |||||
| CVE-2021-35214 | 1 Solarwinds | 1 Pingdom | 2021-10-18 | 1.9 LOW | 4.7 MEDIUM |
| The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the user session. This issue has been resolved on September 13, 2021. | |||||
| CVE-2021-35223 | 1 Solarwinds | 1 Serv-u | 2021-09-16 | 6.5 MEDIUM | 8.8 HIGH |
| The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution. | |||||
| CVE-2021-35238 | 1 Solarwinds | 1 Orion Platform | 2021-09-09 | 3.5 LOW | 4.8 MEDIUM |
| User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website. | |||||
| CVE-2021-35240 | 2 Microsoft, Solarwinds | 2 Internet Explorer, Orion Platform | 2021-09-09 | 3.5 LOW | 4.8 MEDIUM |
| A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'. | |||||
| CVE-2021-35222 | 2 Microsoft, Solarwinds | 2 Windows, Orion Platform | 2021-09-09 | 4.3 MEDIUM | 9.6 CRITICAL |
| This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page. | |||||
| CVE-2021-35220 | 1 Solarwinds | 1 Orion Platform | 2021-09-08 | 6.5 MEDIUM | 7.2 HIGH |
| Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page. | |||||
| CVE-2021-35239 | 1 Solarwinds | 1 Orion Platform | 2021-09-08 | 3.5 LOW | 5.4 MEDIUM |
| A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink. | |||||
| CVE-2019-3980 | 1 Solarwinds | 1 Dameware Mini Remote Control | 2021-07-21 | 10.0 HIGH | 9.8 CRITICAL |
| The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host. An unauthenticated, remote attacker can request smart card login and upload and execute an arbitrary executable run under the Local System account. | |||||
| CVE-2019-16954 | 1 Solarwinds | 1 Web Help Desk | 2021-07-21 | 4.9 MEDIUM | 5.4 MEDIUM |
| SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket. | |||||
| CVE-2020-15574 | 1 Solarwinds | 1 Serv-u | 2021-07-21 | 5.0 MEDIUM | 7.5 HIGH |
| SolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893. | |||||
| CVE-2020-15576 | 1 Solarwinds | 1 Serv-u | 2021-07-21 | 5.0 MEDIUM | 7.5 HIGH |
| SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response. | |||||
| CVE-2019-12864 | 1 Solarwinds | 3 Netpath, Network Performance Monitor, Orion Platform | 2021-07-21 | 2.1 LOW | 5.5 MEDIUM |
| SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query parameter. | |||||
| CVE-2020-15541 | 1 Solarwinds | 1 Serv-u Ftp Server | 2021-07-21 | 7.5 HIGH | 9.8 CRITICAL |
| SolarWinds Serv-U FTP server before 15.2.1 allows remote command execution. | |||||
| CVE-2019-3957 | 1 Solarwinds | 1 Dameware Mini Remote Control | 2021-07-21 | 5.8 MEDIUM | 7.4 HIGH |
| Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating RsaSignatureLen during key negotiation, which could crash the application or leak sensitive information. | |||||
| CVE-2019-16959 | 1 Solarwinds | 1 Webhelpdesk | 2021-07-21 | 4.0 MEDIUM | 6.5 MEDIUM |
| SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket. | |||||
| CVE-2020-25621 | 1 Solarwinds | 1 N-central | 2021-07-21 | 2.1 LOW | 8.4 HIGH |
| An issue was discovered in SolarWinds N-Central 12.3.0.670. The local database does not require authentication: security is only based on ability to access a network interface. The database has keys and passwords. | |||||
| CVE-2020-13912 | 1 Solarwinds | 1 Advanced Monitoring Agent | 2021-07-21 | 6.0 MEDIUM | 7.3 HIGH |
| SolarWinds Advanced Monitoring Agent before 10.8.9 allows local users to gain privileges via a Trojan horse .exe file, because everyone can write to a certain .exe file. | |||||
| CVE-2021-27277 | 1 Solarwinds | 1 Orion Platform | 2021-07-20 | 7.2 HIGH | 7.8 HIGH |
| This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual Infrastructure Monitor 2020.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the OneTimeJobSchedulerEventsService WCF service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-11955. | |||||
| CVE-2021-31217 | 1 Solarwinds | 1 Dameware Mini Remote Control | 2021-07-15 | 9.4 HIGH | 9.1 CRITICAL |
| In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM. | |||||