Solarwinds
Page 2 of 3 — Solarwinds CVEs from a corpus of 250, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40056 | High | 8.0 | 2023-11-28 | SQL Injection Remote Code Vulnerability was found in the SolarWinds Platform. This vulnerability can be exploited with a low privileged account. … |
CVE-2023-40055 | High | 8.0 | 2023-11-09 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to… |
CVE-2023-40054 | High | 8.0 | 2023-11-09 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to… |
CVE-2023-40062 | High | 8.0 | 2023-11-01 | SolarWinds Platform Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability. If executed, this vulnerability would allow a low-privileged user… |
CVE-2023-40061 | High | 8.8 | 2023-11-01 | Insecure job execution mechanism vulnerability. This vulnerability can lead to other attacks as a result. |
CVE-2023-33228 | Medium | 4.5 | 2023-11-01 | The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with admin… |
CVE-2023-33227 | High | 8.0 | 2023-11-01 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability This vulnerability allows a low level user to pe… |
CVE-2023-33226 | High | 8.0 | 2023-11-01 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to… |
CVE-2023-35187 | High | 8.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability allows an unauthenticated user to a… |
CVE-2023-35186 | High | 8.0 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWind… |
CVE-2023-35185 | Medium | 6.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability using SYSTEM privileges. |
CVE-2023-35184 | High | 8.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse a Solar… |
CVE-2023-35183 | High | 7.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows authenticated users to abuse local resour… |
CVE-2023-35182 | High | 8.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on Solar… |
CVE-2023-35181 | High | 7.8 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permissio… |
CVE-2023-35180 | High | 8.0 | 2023-10-19 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows authenticated users to abuse SolarWinds… |
CVE-2023-23845 | Medium | 6.8 | 2023-09-13 | The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web… |
CVE-2023-23840 | Medium | 6.8 | 2023-09-13 | The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web… |
CVE-2023-40060 | High | 7.2 | 2023-09-07 | A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication… |
CVE-2023-35179 | High | 7.2 | 2023-08-11 | A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must ha… |
CVE-2023-3622 | Medium | 4.3 | 2023-07-26 | Access Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to read arbitrary resource |
CVE-2023-33229 | Low | 3.5 | 2023-07-26 | The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWin… |
CVE-2023-23842 | High | 7.2 | 2023-07-26 | The SolarWinds Network Configuration Manager was susceptible to the Directory Traversal Vulnerability. This vulnerability allows users with administrative acce… |
CVE-2023-33225 | High | 7.2 | 2023-07-26 | The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web… |
CVE-2023-33224 | High | 7.2 | 2023-07-26 | The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds… |
CVE-2023-23844 | High | 7.2 | 2023-07-26 | The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web… |
CVE-2023-23843 | High | 7.2 | 2023-07-26 | The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web… |
CVE-2023-33231 | Medium | 6.1 | 2023-07-18 | XSS attack was possible in DPA 2023.2 due to insufficient input validation |
CVE-2023-23841 | High | 7.5 | 2023-06-15 | SolarWinds Serv-U is submitting an HTTP request when changing or updating the attributes for File Share or File request. Part of the URL of the request disclo… |
CVE-2023-23839 | Medium | 6.5 | 2023-04-25 | The SolarWinds Platform was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users to access Orion.WebCommunityStr… |
CVE-2023-23838 | Medium | 6.5 | 2023-04-25 | Directory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the server. |
CVE-2023-23837 | High | 7.5 | 2023-04-25 | No exception handling vulnerability which revealed sensitive or excessive information to users. |
CVE-2022-47509 | Medium | 6.1 | 2023-04-21 | The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWin… |
CVE-2022-47505 | High | 7.8 | 2023-04-21 | The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a valid system user a… |
CVE-2022-36963 | High | 7.2 | 2023-04-21 | The SolarWinds Platform was susceptible to the Command Injection Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform a… |
CVE-2023-23836 | High | 7.2 | 2023-02-15 | SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Or… |
CVE-2022-47508 | High | 7.5 | 2023-02-15 | Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but since we were querying for data via IP a… |
CVE-2022-47507 | High | 7.2 | 2023-02-15 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2022-47506 | High | 7.8 | 2023-02-15 | SolarWinds Platform was susceptible to the Directory Traversal Vulnerability. This vulnerability allows a local adversary with authenticated account access to… |
CVE-2022-47504 | High | 7.2 | 2023-02-15 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2022-47503 | High | 7.2 | 2023-02-15 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2022-38111 | High | 7.2 | 2023-02-15 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2022-47012 | High | 7.5 | 2023-01-20 | Use of uninitialized variable in function gen_eth_recv in GNS3 dynamips 0.2.21. |
CVE-2022-38112 | High | 7.5 | 2023-01-20 | In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext. |
CVE-2022-38110 | Medium | 5.4 | 2023-01-20 | In Database Performance Analyzer (DPA) 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site scripting. |
CVE-2022-47512 | Medium | 5.5 | 2022-12-19 | Sensitive information was stored in plain text in a file that is accessible by a user with a local account in Hybrid Cloud Observability (HCO)/ SolarWinds Plat… |
CVE-2022-38106 | Medium | 5.4 | 2022-12-16 | This vulnerability happens in the web client versions 15.3.0 to Serv-U 15.3.1. This vulnerability affects the directory creation function. |
CVE-2021-35252 | High | 7.5 | 2022-12-16 | Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker… |
CVE-2022-36964 | High | 8.8 | 2022-11-29 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web… |
CVE-2022-36962 | High | 7.2 | 2022-11-29 | SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarWinds database to ex… |
CVE-2022-36960 | High | 8.8 | 2022-11-29 | SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to e… |
CVE-2022-38115 | Medium | 5.3 | 2022-11-23 | Insecure method vulnerability in which allowed HTTP methods are disclosed. E.g., OPTIONS, DELETE, TRACE, and PUT |
CVE-2022-38114 | Medium | 6.1 | 2022-11-23 | This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request smuggling or XSS. |
CVE-2022-38113 | Medium | 5.3 | 2022-11-23 | This vulnerability discloses build and services versions in the server response header. |
CVE-2021-35246 | Medium | 5.3 | 2022-11-23 | The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could… |
CVE-2022-38108 | High | 7.2 | 2022-10-20 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2022-36966 | Medium | 5.4 | 2022-10-20 | Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (I… |
CVE-2022-36958 | High | 8.8 | 2022-10-20 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web… |
CVE-2022-36957 | High | 7.2 | 2022-10-20 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2022-38107 | Medium | 5.3 | 2022-10-19 | Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details. |
CVE-2021-35226 | Medium | 6.5 | 2022-10-10 | An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). Exposed credentials a… |
CVE-2022-36965 | Medium | 6.1 | 2022-09-30 | Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWind… |
CVE-2022-36961 | High | 8.8 | 2022-09-30 | A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code… |
CVE-2021-35249 | Medium | 4.3 | 2022-05-17 | This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should no… |
CVE-2021-35250 | High | 7.5 | 2022-04-25 | A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installation and server files… |
CVE-2021-35229 | Medium | 6.8 | 2022-04-21 | Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL query |
CVE-2021-35254 | High | 8.2 | 2022-03-25 | SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent t… |
CVE-2021-35251 | Medium | 5.3 | 2022-03-10 | Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details about the Web… |
CVE-2021-35247 | Medium | 4.3 | 2022-01-10 | Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perf… |
CVE-2021-35232 | Medium | 6.8 | 2021-12-27 | Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host mach… |
CVE-2021-35243 | Medium | 5.3 | 2021-12-23 | The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests. The HTTP… |
CVE-2021-35248 | Medium | 6.8 | 2021-12-20 | It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings. |
CVE-2021-35244 | Medium | 6.8 | 2021-12-20 | The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker… |
CVE-2021-35234 | High | 8.0 | 2021-12-20 | Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker with low-user privi… |
CVE-2021-35245 | High | 8.4 | 2021-12-06 | When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine. |
CVE-2021-35242 | High | 8.3 | 2021-12-06 | Serv-U server responds with valid CSRFToken when the request contains only Session. |
CVE-2021-35237 | Medium | 5.0 | 2021-10-29 | A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an att… |
CVE-2021-35236 | Low | 3.1 | 2021-10-27 | The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie… |
CVE-2021-35235 | Medium | 5.3 | 2021-10-27 | The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if conf… |
CVE-2021-35233 | Medium | 5.3 | 2021-10-27 | The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the w… |
CVE-2021-35231 | Medium | 6.7 | 2021-10-25 | As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges b… |
CVE-2021-35230 | Medium | 6.7 | 2021-10-22 | As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker could gain escalated privileges by ins… |
CVE-2021-35228 | Medium | 5.5 | 2021-10-21 | This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a… |
CVE-2021-35227 | Medium | 4.7 | 2021-10-21 | The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available. |
CVE-2021-35225 | Medium | 5.0 | 2021-10-21 | Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers… |
CVE-2021-35214 | Medium | 4.8 | 2021-10-12 | The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple a… |
CVE-2021-35217 | High | 8.9 | 2021-09-08 | Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to… |
CVE-2021-35218 | High | 8.9 | 2021-09-01 | Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the O… |
CVE-2021-35216 | High | 8.9 | 2021-09-01 | Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authentica… |
CVE-2021-35215 | High | 8.9 | 2021-09-01 | Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulne… |
CVE-2021-35238 | Medium | 4.8 | 2021-09-01 | User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website. |
CVE-2021-35212 | High | 8.9 | 2021-08-31 | An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injection which could le… |
CVE-2021-35240 | Medium | 6.5 | 2021-08-31 | A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'. |
CVE-2021-35239 | High | 7.5 | 2021-08-31 | A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink. |
CVE-2021-35223 | High | 8.5 | 2021-08-31 | The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that ca… |
CVE-2021-35213 | High | 8.9 | 2021-08-31 | An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to… |
CVE-2021-35222 | High | 8.0 | 2021-08-31 | This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page. |
CVE-2021-35221 | Medium | 6.3 | 2021-08-31 | Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page. |
CVE-2021-35220 | High | 8.1 | 2021-08-31 | Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page. |
CVE-2021-35219 | Medium | 6.0 | 2021-08-31 | ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page. |