Orion Platform at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Latest advisories
-
High max 7.8NCSC-2024-0410 2 CVEs
Kwetsbaarheden verholpen in Solarwinds Platform
Solarwinds heeft kwetsbaarheden verholpen in Solarwinds Platform.
-
High max 7.5NCSC-2024-0239 14 CVEs
Kwetsbaarheden verholpen in Solarwinds Platform
Solarwinds heeft kwetsbaarheden verholpen in Solarwinds Platform.
24 results · Feed
-
High 8.8CVE-2022-36964 EPSS 18%
SolarWinds Platform Deserialization of Untrusted Data
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands.
-
High 7.2
SolarWinds Platform Command Injection
SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarWinds database to execute arbitrary commands.
-
High 8.8
SolarWinds Platform Improper Input Validation
SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges.
-
High 7.2
SolarWinds Platform Deserialization of Untrusted Data
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
-
High 8.8CVE-2022-36958 EPSS 82%
SolarWinds Platform Deserialization of Untrusted Data
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands.
-
High 7.2CVE-2022-36957 EPSS 15%
SolarWinds Platform Deserialization of Untrusted Data
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
-
Medium 6.1
Stored and DOM XSS in QoE Applications: Orion Platform
Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0).
-
High 8.8CVE-2022-36961 EPSS 74%
Orion Platform SQL Injection Privilege Escalation Vulnerability
A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.
-
Medium 6.8
Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6
The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file uplo…
-
High 8.9CVE-2021-35217 EPSS 73%
Insecure Deserialization of untrusted data causing Remote code execution vulnerability.
Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserializat…
-
High 8.9
ActionPluginBaseView Deserialization of Untrusted Data RCE
Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability.
-
Medium 4.8
Stored XSS through URL POST parameter in CreateExternalWebsite Vulnerability
User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.
-
High 8.9
Blind SQL injection Vulnerability
An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injection which could lead to full read/write over the Orion database content including the Orion certificate for any authen…
-
High 8.9
Orion User setting Improper Access Control Privilege Escalation Vulnerability
An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to elevate privileges to the Administrator using this vulnerability. Authentication is required to expl…
-
Medium 6.5
Stored XSS via Help Server settings
A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'.
-
High 7.5
Stored XSS in Maps text box hyperlink Vulnerability
A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.
-
High 8.0
Resource.aspx Reflected Cross-Site Scripting Vulnerability
This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page.
-
Medium 6.3
ImportAlert Improper Access Control Tampering Vulnerability
Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.
-
High 8.1
EmailWebPage Command Injection RCE
Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.
-
Medium 6.0
ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability
ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page.
-
Critical 9.8
This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion…
-
High 7.2CVE-2020-27871 EPSS 91%
This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Plat…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Or…
-
Critical 9.8
SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands
The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise …
KEV Nov 3, 2021