661 matches found
CVE-2019-17127
A Stored Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation...
CVE-2019-17125
A Reflected Client Side Template Injection CSTI with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS...
CVE-2012-2602
Multiple cross-site request forgery CSRF vulnerabilities in SolarWinds Orion Network Performance Monitor NPM before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that 1 create user accounts via CreateUserStepContainer actions to...
CVE-2002-1859
Orion Application Server 1.5.3, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot "WEB-INF."...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: ASoC: kirkwood – Fixed potential NULL dereferencing issues. In kirkwooddmahwparams, mvmbusdraminfo returns NULL if the CONFIGPLATORION macro is not defined. This bug has been fixed by adding a NULL check. This issue was detected ...
CVE-2021-35212
An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injection which could lead to full read/write over the Orion database content including the Orion certificate for any authenticated user...
CVE-2021-35218
Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server...
CVE-2020-27871
This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within...
CVE-2020-27870
This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1. Authentication is required to exploit this vulnerability. The specific flaw exists within ExportToPDF.aspx. The issue results from the lack of proper...
CVE-2025-22363
Missing Authorization vulnerability in Hermann LAHAMI Allada T-shirt Designer for Woocommerce allada-tshirt-designer-for-woocommerce.This issue affects Allada T-shirt Designer for Woocommerce: from n/a through = 1.1...
PT-2025-4475 · WordPress · Orion Allada T-Shirt Designer For Woocommerce
Name of the Vulnerable Software and Affected Versions: ORION Allada T-shirt Designer for Woocommerce versions 1.1 and earlier Description: The issue is related to a Missing Authorization vulnerability. This problem affects the ORION Allada T-shirt Designer for Woocommerce, allowing unauthorized...
Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation', 'Description' = %q This module exploits a stacked SQL injection in order to...
Malicious code in orion-all-6.0.2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69cdfcd30937378c6d65748e8691cd457c6371491dedb166400380429d98ade6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-7980 Malicious code in orion-all-6.0.2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69cdfcd30937378c6d65748e8691cd457c6371491dedb166400380429d98ade6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in orion-algo-extrapol (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 746265a1e23f0f71fc8f64babb2fed09f5737a4a323d309c2087e90dacfa2b73 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2024-11651 Malicious code in orion-algo-extrapol (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 746265a1e23f0f71fc8f64babb2fed09f5737a4a323d309c2087e90dacfa2b73 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
orionairsales.co.uk Cross Site Scripting vulnerability OBB-3949384
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
The vulnerability of the Orion Login.aspx page of the SolarWinds Platform’s network monitoring and IT infrastructure management software allows a perpetrator to carry out a brute-force attack.
The vulnerability of the Orion Login.aspx page of the SolarWinds IT infrastructure monitoring and management software is related to synchronization errors when using a common resource. Exploiting this vulnerability could allow a malicious actor to carry out a brute-force attack...