CVE-2018-19386

SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI...

CVE-2018-19386

SolarWinds Database Performance Analyzer 11.1.457 contains a reflected XSS in idcStateError where the page parameter is reflected into the HREF of the “Try Again” button at /iwc/idcStateError.iwc?page=. Exploitation would execute script in the victim’s browser, potentially enabling session hijack...

BADministration - Tool Which Interfaces with Management or Administration Applications from an Offensive Standpoint

BADministration is a tool which interfaces with management or administration applications from an offensive standpoint. It attempts to provide offsec personnel a tool with the ability to identify and leverage these non-technical vulnerabilities. As always: use for good, promote security, and figh...

(0Day) SolarWinds Orion Network Performance Monitor ExecuteExternalProgram Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Network Performance Monitor. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exist...

SolarWinds Network Performance Monitor SQL Injection Vulnerability

SolarWinds Network Performance Monitor NPM is a network performance monitor from SolarWinds, Inc. that provides monitoring and reporting, tracking of up/down status, real-time analytics, and network performance statistics for routers, virtualized environments, and other devices. A SQL injection...

CVE-2018-13442

SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter...

CVE-2018-13442

SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter...

Sql injection

SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter...

CVE-2018-13442

SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter...

CVE-2018-13442

The CVE-2018-13442 entry concerns SolarWinds Network Performance Monitor 12.3 and an SQL Injection vulnerability exposed via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter. Multiple connected sources describe the root cause as lack of proper validation of ...

Serv-U FTP Server - prepareinstallation Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Serv-U FTP Server prepareinstallation Privilege Escalation', 'Description' = %q This module attempts to gain root privileges on systems running...

SolarWinds Dameware Mini Remote Control Client Public Key Buffer Over-read

The SolarWinds Dameware Mini Remote Control Client Agent running on the remote host is affected by a buffer over-read vulnerability due to improper validation of user-supplied data. An unauthenticated, remote attacker can exploit this, via a series of requests, to cause a denial of service...

CVE-2019-12181

A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux...

CVE-2019-12181

A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux...

Privilege escalation

A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux...

CVE-2019-12181

A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux...

CVE-2019-12181

CVE-2019-12181 affects SolarWinds Serv-U on Linux prior to 15.1.7. A root privilege escalation exists in the Serv-U binary when invoked with the -prepareinstallation flag: the executable is setuid root and uses an unvalidated ARGV[0] in a call to system(), allowing command execution with root pri...

Serv-U FTP Server prepareinstallation Privilege Escalation

A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux. Recent assessments: pbarry-r7 at November 21, 2019 6:58pm UTC reported: Sounds like this vuln appears in a LOT of versions of the software. Probably should update to v15.1.7+. Assessed Attacker Value: 5...

PT-2019-12684 · Solarwinds · Serv-U

Name of the Vulnerable Software and Affected Versions: SolarWinds Serv-U versions prior to 15.1.7 for Linux. Description: A privilege escalation issue exists, allowing potential exploitation. Recommendations: For versions prior to 15.1.7, update to version 15.1.7 or later to resolve the issue...

SolarWinds Dameware Remote Mini Control Buffer Overflow Vulnerability

SolarWinds Dameware Remote Mini Control is a suite of remote control software for laptops and servers from SolarWinds, Inc. that provides remote desktop access and screen sharing capabilities. A buffer overflow vulnerability exists in SolarWinds Dameware Remote Mini Control version 12.1.0.34 and...