Skip to content
OpenAdvisories

Vendor

SolarWinds

218 known vulnerabilities.

Products

SolarWinds Platform 41 Serv-U 34 Access Rights Manager 33 Orion Platform 24 Web Help Desk 19 SolarWinds Observability Self-Hosted 10 Network Configuration Manager 7 Kiwi Syslog Server 5 Database Performance Analyzer 4 Patch Manager 4 Observability Self-Hosted 4 SolarWinds SEM 3 Dameware 3 Database Performance Analyzer (DPA) 2 Kiwi CatTools 2 SolarWinds 2 ServU 2 Network Performance Monitor 2 SolarWinds Serv-U 1 Orion Job Scheduler 1 Dameware Mini Remote Control Service 1 Serv-U File Server 1 SQL Sentry 1 Kiwi Syslog NG 1 Service Desk 1 Orion Virtual Infrastructure Monitor 1 DPA 1 Hybrid Cloud Observability (HCO)/ SolarWinds Platform 1 Serv-U FTP Server 1 Server & Application Monitor (SAM) 1 Pingdom 1 Orion 1 Security Event Manager 1 Engineer's Toolset 1 Database Performance Monitor 1 Serv-U Managed File Transfer Server and Serv-U Secured FTP 1 NPM 1 Serv-U Server 1 Orion Core 1 WebHelpDesk 1
All Critical High Medium Low Exploited only Public exploit

218 results · Feed

  • High 8.9
    CVE-2021-35213

    Orion User setting Improper Access Control Privilege Escalation Vulnerability

    An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to elevate privileges to the Administrator using this vulnerability. Authentication is required to expl…

    SolarWinds Orion Platform
  • Medium 6.5
    CVE-2021-35240

    Stored XSS via Help Server settings

    A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'.

    SolarWinds Orion Platform
  • High 7.5
    CVE-2021-35239

    Stored XSS in Maps text box hyperlink Vulnerability

    A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.

    SolarWinds Orion Platform
  • High 8.0
    CVE-2021-35222

    Resource.aspx Reflected Cross-Site Scripting Vulnerability

    This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page.

    SolarWinds Orion Platform
  • Medium 6.3
    CVE-2021-35221

    ImportAlert Improper Access Control Tampering Vulnerability

    Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.

    SolarWinds Orion Platform
  • High 8.1
    CVE-2021-35220

    EmailWebPage Command Injection RCE

    Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.

    SolarWinds Orion Platform
  • Medium 6.0
    CVE-2021-35219

    ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability

    ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page.

    SolarWinds Orion Platform
  • Medium 5.3
    CVE-2021-32076

    Access Restriction bypass vulnerability via referrer spoof - Business Logic Bypass

    Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or lo…

    SolarWinds Web Help Desk
  • Critical 9.0
    CVE-2021-35211 Exploited · Ransomware Public exploit Scanner template EPSS 91%

    Serv-U Remote Memory Escape Vulnerability

    Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds…

    SolarWinds Serv-U Managed File Transfer Server and Serv-U Secured FTP
    KEV Nov 3, 2021
  • High 8.8
    CVE-2021-31475

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job …

    SolarWinds Orion Job Scheduler
  • Critical 9.8
    CVE-2021-31474 EPSS 94%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Pe…

    SolarWinds Network Performance Monitor
  • High 7.8
    CVE-2021-27277

    This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual …

    SolarWinds Orion Virtual Infrastructure Monitor
  • Critical 9.8
    CVE-2021-27258

    This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion…

    SolarWinds Orion Platform
  • High 7.8
    CVE-2021-27240

    This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Patch Manager …

    SolarWinds Patch Manager
  • High 8.8
    CVE-2020-27869

    This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Perfo…

    SolarWinds Network Performance Monitor
  • High 7.2
    CVE-2020-27871 EPSS 91%

    This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Plat…

    SolarWinds Orion Platform
  • High 7.5
    CVE-2020-27870

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Or…

    SolarWinds Orion Platform
  • Critical 9.8
    CVE-2020-10148 Exploited Public exploit Scanner template EPSS 92%

    SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

    The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise …

    SolarWinds Orion Platform
    KEV Nov 3, 2021