16 results · Clear filters · Feed
-
High 8.8CVE-2022-36964 EPSS 18%
SolarWinds Platform Deserialization of Untrusted Data
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands.
-
High 7.2
SolarWinds Platform Command Injection
SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarWinds database to execute arbitrary commands.
-
High 8.8
SolarWinds Platform Improper Input Validation
SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges.
-
High 7.2
SolarWinds Platform Deserialization of Untrusted Data
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
-
High 8.8CVE-2022-36958 EPSS 82%
SolarWinds Platform Deserialization of Untrusted Data
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands.
-
High 7.2CVE-2022-36957 EPSS 15%
SolarWinds Platform Deserialization of Untrusted Data
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
-
High 8.8CVE-2022-36961 EPSS 74%
Orion Platform SQL Injection Privilege Escalation Vulnerability
A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.
-
High 8.9CVE-2021-35217 EPSS 73%
Insecure Deserialization of untrusted data causing Remote code execution vulnerability.
Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserializat…
-
High 8.9
ActionPluginBaseView Deserialization of Untrusted Data RCE
Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability.
-
High 8.9
Blind SQL injection Vulnerability
An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injection which could lead to full read/write over the Orion database content including the Orion certificate for any authen…
-
High 8.9
Orion User setting Improper Access Control Privilege Escalation Vulnerability
An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to elevate privileges to the Administrator using this vulnerability. Authentication is required to expl…
-
High 7.5
Stored XSS in Maps text box hyperlink Vulnerability
A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.
-
High 8.0
Resource.aspx Reflected Cross-Site Scripting Vulnerability
This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page.
-
High 8.1
EmailWebPage Command Injection RCE
Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.
-
High 7.2CVE-2020-27871 EPSS 91%
This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Plat…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Or…