Filtered by vendor Solarwinds
Subscribe
Total
249 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-27870 | 1 Solarwinds | 1 Orion Platform | 2023-12-10 | 4.0 MEDIUM | 6.5 MEDIUM |
| This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1. Authentication is required to exploit this vulnerability. The specific flaw exists within ExportToPDF.aspx. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-11917. | |||||
| CVE-2020-25622 | 1 Solarwinds | 1 N-central | 2023-12-10 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF. | |||||
| CVE-2019-16959 | 1 Solarwinds | 1 Webhelpdesk | 2023-12-10 | 4.0 MEDIUM | 6.5 MEDIUM |
| SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket. | |||||
| CVE-2020-25618 | 1 Solarwinds | 1 N-central | 2023-12-10 | 9.0 HIGH | 8.8 HIGH |
| An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access control because the nable web user account is effectively able to run arbitrary OS commands as root (i.e., the use of root privileges is not limited to specific programs listed in the sudoers file). | |||||
| CVE-2020-25620 | 1 Solarwinds | 1 N-central | 2023-12-10 | 4.6 MEDIUM | 7.8 HIGH |
| An issue was discovered in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by default for local user accounts named support@n-able.com and nableadmin@n-able.com. These allow logins to the N-Central Administrative Console (NAC) and/or the regular web interface. | |||||
| CVE-2019-16957 | 1 Solarwinds | 1 Webhelpdesk | 2023-12-10 | 3.5 LOW | 5.4 MEDIUM |
| SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account. | |||||
| CVE-2020-35482 | 1 Solarwinds | 1 Serv-u | 2023-12-10 | 3.5 LOW | 5.4 MEDIUM |
| SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS. | |||||
| CVE-2021-25276 | 1 Solarwinds | 1 Serv-u | 2023-12-10 | 3.6 LOW | 7.1 HIGH |
| In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable and writable. An unprivileged Windows user (having access to the server's filesystem) can add an FTP user by copying a valid profile file to this directory. For example, if this profile sets up a user with a C:\ home directory, then the attacker obtains access to read or replace arbitrary files with LocalSystem privileges. | |||||
| CVE-2018-16243 | 1 Solarwinds | 1 Database Performance Analyzer | 2023-12-10 | 3.5 LOW | 5.4 MEDIUM |
| SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralManage.cen, userAdministration.iwc, database.iwc, alertManagement.iwc, eventAnnotations.iwc, and central.cen. | |||||
| CVE-2020-25621 | 1 Solarwinds | 1 N-central | 2023-12-10 | 2.1 LOW | 8.4 HIGH |
| An issue was discovered in SolarWinds N-Central 12.3.0.670. The local database does not require authentication: security is only based on ability to access a network interface. The database has keys and passwords. | |||||
| CVE-2019-16956 | 1 Solarwinds | 1 Web Help Desk | 2023-12-10 | 3.5 LOW | 5.4 MEDIUM |
| SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket. | |||||
| CVE-2019-16954 | 1 Solarwinds | 1 Web Help Desk | 2023-12-10 | 4.9 MEDIUM | 5.4 MEDIUM |
| SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket. | |||||
| CVE-2020-27871 | 1 Solarwinds | 1 Orion Platform | 2023-12-10 | 9.0 HIGH | 7.2 HIGH |
| This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within VulnerabilitySettings.aspx. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-11902. | |||||
| CVE-2019-20002 | 1 Solarwinds | 1 Webhelpdesk | 2023-12-10 | 6.0 MEDIUM | 7.8 HIGH |
| Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value (provided by a low-privileged user in the Subject field of a help request form) that is mishandled in a TicketActions/view?tab=group TSV export by an admin user. | |||||
| CVE-2020-12608 | 1 Solarwinds | 1 Managed Service Provider Patch Management Engine | 2023-12-10 | 9.3 HIGH | 7.8 HIGH |
| An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecure file permissions for %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.CacheService\config\. This can lead to code execution by changing the CacheService.xml SISServerURL parameter. | |||||
| CVE-2020-15574 | 1 Solarwinds | 1 Serv-u | 2023-12-10 | 5.0 MEDIUM | 7.5 HIGH |
| SolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893. | |||||
| CVE-2019-12769 | 1 Solarwinds | 1 Serv-u Managed File Transfer | 2023-12-10 | 6.8 MEDIUM | 8.8 HIGH |
| SolarWinds Serv-U Managed File Transfer (MFT) Web client before 15.1.6 Hotfix 2 is vulnerable to Cross-Site Request Forgery in the file upload functionality via ?Command=Upload with the Dir and File parameters. | |||||
| CVE-2020-15541 | 1 Solarwinds | 1 Serv-u Ftp Server | 2023-12-10 | 7.5 HIGH | 9.8 CRITICAL |
| SolarWinds Serv-U FTP server before 15.2.1 allows remote command execution. | |||||
| CVE-2020-15575 | 1 Solarwinds | 1 Serv-u | 2023-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| SolarWinds Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan, aka Case Number 00484194. | |||||
| CVE-2020-5734 | 1 Solarwinds | 1 Dameware | 2023-12-10 | 4.3 MEDIUM | 7.5 HIGH |
| Classic buffer overflow in SolarWinds Dameware allows a remote, unauthenticated attacker to cause a denial of service by sending a large 'SigPubkeyLen' during ECDH key exchange. | |||||