3098 matches found
CVE-2020-15576
SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response...
CVE-2020-25617
An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows Relative Path Traversal by an authenticated user of the N-Central Administration Console NAC, leading to execution of OS commands as root...
CVE-2020-27994
SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal...
CVE-2020-13169
Stored XSS Cross-Site Scripting exists in the SolarWinds Orion Platform before before 2020.2.1 on multiple forms and pages. This vulnerability may lead to the Information Disclosure and Escalation of Privileges takeover of administrator account...
CVE-2020-22428
SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting XSS via a directory name entered by an admin containing a JavaScript payload...
CVE-2020-28001
SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS...
CVE-2020-15541
SolarWinds Serv-U FTP server before 15.2.1 allows remote command execution...
CVE-2020-15543
SolarWinds Serv-U FTP server before 15.2.1 does not validate an argument path...
CVE-2020-15573
SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421...
CVE-2020-15542
SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command...
CVE-2020-14007
Solarwinds Orion with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4 allows XSS via a name of an alert definition...
CVE-2020-25618
An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access control because the nable web user account is effectively able to run arbitrary OS commands as root i.e., the use of root privileges is not limited to specific programs listed in the sudoers fi...
CVE-2020-13912
SolarWinds Advanced Monitoring Agent before 10.8.9 allows local users to gain privileges via a Trojan horse .exe file, because everyone can write to a certain .exe file...
CVE-2020-35856
SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page...
CVE-2020-35482
SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS...
CVE-2020-25622
An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF...
CVE-2020-25620
An issue was discovered in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by default for local user accounts named [email protected] and [email protected]. These allow logins to the N-Central Administrative Console NAC and/or the regular web interface...
CVE-2020-15910
SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be...