Filtered by vendor Solarwinds
Subscribe
Total
289 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-16955 | 1 Solarwinds | 1 Webhelpdesk | 2020-12-18 | 3.5 LOW | 5.4 MEDIUM |
| SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request. | |||||
| CVE-2020-25617 | 1 Solarwinds | 1 N-central | 2020-12-18 | 9.0 HIGH | 8.8 HIGH |
| An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows Relative Path Traversal by an authenticated user of the N-Central Administration Console (NAC), leading to execution of OS commands as root. | |||||
| CVE-2018-16792 | 1 Solarwinds | 1 Sftp\/scp Server | 2020-12-18 | 6.4 MEDIUM | 9.1 CRITICAL |
| SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data. | |||||
| CVE-2020-25622 | 1 Solarwinds | 1 N-central | 2020-12-17 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF. | |||||
| CVE-2018-16243 | 1 Solarwinds | 1 Database Performance Analyzer | 2020-12-17 | 3.5 LOW | 5.4 MEDIUM |
| SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralManage.cen, userAdministration.iwc, database.iwc, alertManagement.iwc, eventAnnotations.iwc, and central.cen. | |||||
| CVE-2019-16958 | 1 Solarwinds | 1 Help Desk | 2020-12-02 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site Scripting (XSS) vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject arbitrary web script or HTML via Location Name. | |||||
| CVE-2020-15910 | 1 Solarwinds | 1 N-central | 2020-10-29 | 4.3 MEDIUM | 4.7 MEDIUM |
| SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be forwarded to the attacker. | |||||
| CVE-2020-15909 | 1 Solarwinds | 1 N-central | 2020-10-29 | 6.8 MEDIUM | 8.8 HIGH |
| SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take advantage of this, cookie could be stolen and the JSESSIONID can be captured. On its own this is not a surprising result; low security tools allow the cookie to roam from machine to machine. The JSESSION cookie can then be used on the attackers’ workstation by browsing to the victim’s NCentral server URL and replacing the JSESSIONID attribute value by the captured value. Expected behavior would be to check this against a second source and enforce at least a reauthentication or multi factor request as N-Central is a highly privileged service. | |||||
| CVE-2019-8917 | 1 Solarwinds | 1 Orion Network Performance Monitor | 2020-08-24 | 10.0 HIGH | 9.8 CRITICAL |
| SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote, unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method may be abused by an attacker to execute commands as the SYSTEM user. | |||||
| CVE-2019-12863 | 1 Solarwinds | 3 Netpath, Network Performance Monitor, Orion Platform | 2020-08-24 | 3.5 LOW | 4.8 MEDIUM |
| SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen. | |||||
| CVE-2019-9546 | 1 Solarwinds | 1 Orion Platform | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service. | |||||
| CVE-2019-13181 | 1 Solarwinds | 1 Serv-u Ftp Server | 2020-08-24 | 4.0 MEDIUM | 6.5 MEDIUM |
| A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7. | |||||
| CVE-2011-4800 | 1 Solarwinds | 1 Serv-u File Server | 2020-07-28 | 9.0 HIGH | N/A |
| Directory traversal vulnerability in Serv-U FTP Server before 11.1.0.5 allows remote authenticated users to read and write arbitrary files, and list and create arbitrary directories, via a "..:/" (dot dot colon forward slash) in the (1) list, (2) put, or (3) get commands. | |||||
| CVE-2009-4815 | 1 Solarwinds | 1 Serv-u File Server | 2020-07-28 | 4.0 MEDIUM | N/A |
| Directory traversal vulnerability in Serv-U before 9.2.0.1 allows remote authenticated users to read arbitrary files via unspecified vectors. | |||||
| CVE-2009-3655 | 1 Solarwinds | 1 Serv-u File Server | 2020-07-28 | 5.0 MEDIUM | N/A |
| Rhino Software Serv-U 7.0.0.1 through 8.2.0.3 allows remote attackers to cause a denial of service (server crash) via unspecified vectors related to the "SITE SET TRANSFERPROGRESS ON" FTP command. | |||||
| CVE-2009-4006 | 1 Solarwinds | 1 Serv-u File Server | 2020-07-28 | 10.0 HIGH | N/A |
| Stack-based buffer overflow in the TEA decoding algorithm in RhinoSoft Serv-U FTP server 7.0.0.1, 9.0.0.5, and other versions before 9.1.0.0 allows remote attackers to execute arbitrary code via a long hexadecimal string. | |||||
| CVE-2008-4500 | 1 Solarwinds | 1 Serv-u File Server | 2020-07-28 | 4.0 MEDIUM | N/A |
| Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted stou command, probably related to MS-DOS device names, as demonstrated using "con:1". | |||||
| CVE-2009-0967 | 1 Solarwinds | 1 Serv-u File Server | 2020-07-28 | 4.0 MEDIUM | N/A |
| The FTP server in Serv-U 7.0.0.1 through 7.4.0.1 allows remote authenticated users to cause a denial of service (service hang) via a large number of SMNT commands without an argument. | |||||
| CVE-2008-4501 | 1 Solarwinds | 1 Serv-u File Server | 2020-07-28 | 9.0 HIGH | N/A |
| Directory traversal vulnerability in the FTP server in Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to overwrite or create arbitrary files via a ..\ (dot dot backslash) in the RNTO command. | |||||
| CVE-2008-3731 | 1 Solarwinds | 1 Serv-u File Server | 2020-07-28 | 4.0 MEDIUM | N/A |
| Unspecified vulnerability in Serv-U File Server 7.0.0.1, and other versions before 7.2.0.1, allows remote authenticated users to cause a denial of service (daemon crash) via an SSH session with SFTP commands for directory creation and logging. | |||||