Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the web interface in the Scheduler in SolarWinds formerly Serv-U FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that 1 change the admin password, 2 terminate the scheduler, or 3 possibly...

CVE-2017-6803

CVE-2017-6803 affects SolarWinds (formerly Serv-U) FTP Voyager Scheduler 16.2.0. The vulnerability is described as multiple cross-site request forgery (CSRF) flaws in the Scheduler web interface that let an attacker hijack a user’s session to perform actions such as (1) changing the admin passwor...

CVE-2017-6803

Multiple cross-site request forgery CSRF vulnerabilities in the web interface in the Scheduler in SolarWinds formerly Serv-U FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that 1 change the admin password, 2 terminate the scheduler, or 3 possibly...

CVE-2017-6803: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the web interface in the Scheduler in SolarWinds formerly Serv-U FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that 1 change the admin password, 2 terminate the scheduler, or 3 possibly...

PT-2017-17335

Name of the Vulnerable Software and Affected Versions SolarWinds FTP Voyager version 16.2.0 Description The issue affects the web interface in the Scheduler of SolarWinds FTP Voyager, allowing remote attackers to hijack user authentication for specific requests. This can lead to actions such as...

SolarWinds LEM 6.3.1 - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "SolarWind LEM Default SSH Password Remote Code Execution", 'Description' = %q This module exploits the default credentials of SolarWind LEM. A men...

PT-2017-3092

Name of the Vulnerable Software and Affected Versions SolarWinds Log & Event Manager LEM versions prior to 6.3.1 Hotfix 4 Description The issue is related to the restrictssh feature in the menuing script of SolarWinds Log & Event Manager LEM. An attacker can exploit this to escape from the...

SolarWinds LEM Default SSH Password Remote Code Execution

This module exploits the default credentials of SolarWinds LEM. A menu system is encountered when the SSH service is accessed with the default username and password which is "cmc" and "password". By exploiting a vulnerability that exist on the menuing script, an attacker can escape from restricte...

FTP Voyager Scheduler 16.2.0 CSRF / Denial Of Service

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/FTP-VOYAGER-SCHEDULER-CSRF-REMOTE-CMD-EXECUTION.txt + ISR: ApparitionSec Vendor: ============== solarwinds.com www.serv-u.com Product: ==================== FTP Voyager...

FTP Voyager Scheduler 16.2.0 - Cross-Site Request Forgery

FTP Voyager Scheduler 16.2.0 - Cross-Site Request Forgery !-- + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/FTP-VOYAGER-SCHEDULER-CSRF-REMOTE-CMD-EXECUTION.txt + ISR: ApparitionSec Vendor: ============== solarwinds.com...

FTP Voyager Scheduler 16.2.0 - Cross-Site Request Forgery

!-- + Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/FTP-VOYAGER-SCHEDULER-CSRF-REMOTE-CMD-EXECUTION.txt + ISR: ApparitionSec Vendor: ============== solarwinds.com www.serv-u.com Product: ==================== FTP Voyager...

solarwinds.com XSS vulnerability

Vulnerable URL: http://www.solarwinds.com/resources/vpats.aspx'?page=2 Details: Description| Value ---|--- Patched:| Yes, at 07.11.2017 Latest check for patch:| 07.11.2017 07:50 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 19138 VIP website status:| Yes Check...

demo.solarwinds.com XSS vulnerability

Vulnerable URL: http://demo.solarwinds.com/sedemo/?v=h9tour=EN=%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...

solarwinds.com XSS vulnerability

Vulnerable URL: http://www.solarwinds.com/assets/surveys/2016-it-security-survey-united-kingdom.aspx?CMP=%22-alert/OPENBUGBOUNTY/-%22 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 17291 VIP website status:| Yes...

oriondemo.solarwinds.com XSS vulnerability

Vulnerable URL: http://oriondemo.solarwinds.com/Orion/Login.aspx?c=%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 17377 VIP website status:| Yes Check...

demo.solarwinds.com XSS vulnerability

Vulnerable URL: http://demo.solarwinds.com/sedemo/?v=h9tour=EN=%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...

SolarWinds Storage Resource Monitor (SRM) Detection (HTTP)

HTTP based detection of SolarWinds Storage Resource Monitor SRM. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SolarWinds Storage Resource Monitor (SRM) < 6.2.3 Multiple SQLi Vulnerabilities

SolarWinds Storage Resource Monitor SRM is prone to multiple SQL injection SQLi vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

SolarWinds Kiwi Syslog Server Service Path Privilege Elevation Vulnerability

SolarWinds Kiwi Syslog Server is a syslog server for IT administrators and network teams. SolarWinds Kiwi Syslog Server has a security vulnerability. It allows a local user to elevate privileges on the system to execute arbitrary code...

SolarWinds Kiwi Syslog Server 9.5.1 - Unquoted Service Path Privilege Escalation

Exploit for windows platform in category local exploits Document Title: ================ SolarWinds Kiwi Syslog Server Unquoted Service Path Privilege Escalation Vulnerability Author: ======== Halil Dalabasmaz Release Date: ============== 29 SEP 2016 Product & Service Introduction:...