Skip to content
OpenAdvisories

Vendor

SolarWinds

218 known vulnerabilities.

Products

SolarWinds Platform 41 Serv-U 34 Access Rights Manager 33 Orion Platform 24 Web Help Desk 19 SolarWinds Observability Self-Hosted 10 Network Configuration Manager 7 Kiwi Syslog Server 5 Database Performance Analyzer 4 Patch Manager 4 Observability Self-Hosted 4 SolarWinds SEM 3 Dameware 3 Database Performance Analyzer (DPA) 2 Kiwi CatTools 2 SolarWinds 2 ServU 2 Network Performance Monitor 2 SolarWinds Serv-U 1 Orion Job Scheduler 1 Dameware Mini Remote Control Service 1 Serv-U File Server 1 SQL Sentry 1 Kiwi Syslog NG 1 Service Desk 1 Orion Virtual Infrastructure Monitor 1 DPA 1 Hybrid Cloud Observability (HCO)/ SolarWinds Platform 1 Serv-U FTP Server 1 Server & Application Monitor (SAM) 1 Pingdom 1 Orion 1 Security Event Manager 1 Engineer's Toolset 1 Database Performance Monitor 1 Serv-U Managed File Transfer Server and Serv-U Secured FTP 1 NPM 1 Serv-U Server 1 Orion Core 1 WebHelpDesk 1
All Critical High Medium Low Exploited only Public exploit

96 results · Clear filters · Feed

  • High 8.9
    CVE-2021-35217 EPSS 73%

    Insecure Deserialization of untrusted data causing Remote code execution vulnerability.

    Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserializat…

    SolarWinds Orion Platform
  • High 8.9
    CVE-2021-35218 EPSS 76%

    Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

    Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server

    SolarWinds Patch Manager
  • High 8.9
    CVE-2021-35216 EPSS 81%

    Deserialization of Untrusted Data in Resource Controls Remote Code Execution

    Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authenticated Attacker with network access via HTTP can compromise this vulnerability can result in Remote Cod…

    SolarWinds Patch Manager
  • High 8.9
    CVE-2021-35215 Public exploit EPSS 70%

    ActionPluginBaseView Deserialization of Untrusted Data RCE

    Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability.

    SolarWinds Orion Platform
  • High 8.9
    CVE-2021-35212

    Blind SQL injection Vulnerability

    An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injection which could lead to full read/write over the Orion database content including the Orion certificate for any authen…

    SolarWinds Orion Platform
  • High 8.5
    CVE-2021-35223

    Execute Command Function Allows Remote Code Execution (RCE)Vulnerability

    The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution.

    SolarWinds Serv-U
  • High 8.9
    CVE-2021-35213

    Orion User setting Improper Access Control Privilege Escalation Vulnerability

    An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to elevate privileges to the Administrator using this vulnerability. Authentication is required to expl…

    SolarWinds Orion Platform
  • High 7.5
    CVE-2021-35239

    Stored XSS in Maps text box hyperlink Vulnerability

    A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.

    SolarWinds Orion Platform
  • High 8.0
    CVE-2021-35222

    Resource.aspx Reflected Cross-Site Scripting Vulnerability

    This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page.

    SolarWinds Orion Platform
  • High 8.1
    CVE-2021-35220

    EmailWebPage Command Injection RCE

    Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.

    SolarWinds Orion Platform
  • High 8.8
    CVE-2021-31475

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job …

    SolarWinds Orion Job Scheduler
  • High 7.8
    CVE-2021-27277

    This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual …

    SolarWinds Orion Virtual Infrastructure Monitor
  • High 7.8
    CVE-2021-27240

    This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Patch Manager …

    SolarWinds Patch Manager
  • High 8.8
    CVE-2020-27869

    This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Perfo…

    SolarWinds Network Performance Monitor
  • High 7.2
    CVE-2020-27871 EPSS 91%

    This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Plat…

    SolarWinds Orion Platform
  • High 7.5
    CVE-2020-27870

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Or…

    SolarWinds Orion Platform