Solarwinds: Security Vulnerabilities
Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.
CVSS Score
5.4
EPSS Score
0.004
Published
2022-10-20
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
CVSS Score
7.2
EPSS Score
0.68
Published
2022-10-20
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
CVSS Score
7.2
EPSS Score
0.123
Published
2022-10-20
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands.
CVSS Score
8.8
EPSS Score
0.827
Published
2022-10-20
Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details.
CVSS Score
5.3
EPSS Score
0.006
Published
2022-10-19
An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). Exposed credentials are encrypted and require authenticated access with an NCM role.
CVSS Score
6.5
EPSS Score
0.005
Published
2022-10-10
A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.
CVSS Score
8.8
EPSS Score
0.752
Published
2022-09-30
Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0).
CVSS Score
6.1
EPSS Score
0.006
Published
2022-09-30
This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data (read only operation). This UAC issue leads to a data leak to unauthorized users for a domain, with no log of them accessing the data unless they attempt to modify it. This read-only activity is logged to the original domain and does not specify which domain was accessed.
CVSS Score
4.3
EPSS Score
0.007
Published
2022-05-17
A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installation and server files. This issue has been resolved in Serv-U 15.3 Hotfix 1.
CVSS Score
7.5
EPSS Score
0.128
Published
2022-04-25