Solarwinds: Security Vulnerabilities
The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When running multiple active sessions in separate browser windows, it was observed a password or email address change could be changed without terminating the user session. This issue has been resolved on September 13, 2021.
CVSS Score
4.8
EPSS Score
0.018
Published
2021-10-12
Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.
CVSS Score
8.9
EPSS Score
0.728
Published
2021-09-08
Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability.
CVSS Score
8.9
EPSS Score
0.697
Published
2021-09-01
Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authenticated Attacker with network access via HTTP can compromise this vulnerability can result in Remote Code Execution.
CVSS Score
8.9
EPSS Score
0.814
Published
2021-09-01
Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server
CVSS Score
8.9
EPSS Score
0.764
Published
2021-09-01
User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.
CVSS Score
4.8
EPSS Score
0.011
Published
2021-09-01
An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injection which could lead to full read/write over the Orion database content including the Orion certificate for any authenticated user.
CVSS Score
8.9
EPSS Score
0.016
Published
2021-08-31
An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to elevate privileges to the Administrator using this vulnerability. Authentication is required to exploit the vulnerability.
CVSS Score
8.9
EPSS Score
0.034
Published
2021-08-31
The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution.
CVSS Score
8.5
EPSS Score
0.029
Published
2021-08-31
A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.
CVSS Score
7.5
EPSS Score
0.01
Published
2021-08-31