CVE-2021-35234

Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker with low-user privileges may steal password hashes and password salt information...

Sql injection

Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker with low-user privileges may steal password hashes and password salt information...

Unrestricted file upload

The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution...

Input validation

It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings...

CVE-2021-35234 Exposed Dangerous Functions - Privileged Escalation

Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker with low-user privileges may steal password hashes and password salt information...

CVE-2021-35234

CVE-2021-35234 concerns multiple exposed dangerous functions in SolarWinds Orion Platform (Network Performance Monitor/Orion.Core.Actions.dll, etc.) enabling read-only SQL injection and privilege escalation. Connected advisories (ZDI-21-1602, 1596, 1597, 1598, 1599, 1600–1604) describe remote pri...

EUVD-2021-21887

The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution...

CVE-2021-35244 Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6

The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution...

CVE-2021-35248

SolarWinds Orion contains an issue where any authenticated user (including low-privilege or guest accounts) can query Orion.UserSettings and enumerate users and their basic settings. NVD notes impact to confidentiality (partial) with network-accessible exposure; CVSS vectors indicate low attack c...

CVE-2021-35244

CVE-2021-35244 affects SolarWinds Orion Platform: the Log alert to a file action in Orion alert management allows an authenticated user with alert-management rights to write to arbitrary files, enabling an unrestricted file upload and remote code execution. Public disclosures (ZDI-22-375) describ...

CVE-2021-35234

Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker with low-user privileges may steal password hashes and password salt information...

CVE-2021-35248

It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings...

Solarwinds Orion Platform 代码问题漏洞

Solarwinds Orion Platform is a network fault and network performance management platform from Solarwinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user comments, and a mapped view of the entire network. The...

PT-2021-20866 · Solarwinds · Solarwinds Orion

Name of the Vulnerable Software and Affected Versions: SolarWinds Orion affected versions not specified Description: It has been reported that any Orion user, including guest accounts, can query the Orion.UserSettings entity and enumerate users and their basic settings. Recommendations: At the...

Solarwinds Orion Platform访问控制错误漏洞

Solarwinds Orion Platform is a network fault and network performance management platform from Solarwinds, Inc. The platform provides real-time monitoring and analysis of network devices, as well as support for customized web interfaces, multiple user opinions, and a mapped view of the entire...

SolarWinds Orion SQL注入漏洞

SolarWinds Orion is the centerpiece of an IT management portfolio from SolarWinds. It provides a stable and scalable architecture that includes data collection, processing, storage, and representation. SolarWinds Orion suffers from a SQL injection vulnerability that can be exploited by an attacke...

SolarWinds Orion Platform 2020.2.6 < 2020.2.6 HF3 SQLI

The version of SolarWinds Orion Platform installed on the remote host is prior to 2020.2.6 HF3. It is, therefore, affected by a vulnerability as referenced in the orionplatform202026hf3 advisory. - Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leadi...

The vulnerability of the SaveUserSetting component in the SolarWinds Orion Platform software monitoring solution allows a hacker to elevate their privileges to the level of an administrator.

The vulnerability of the SaveUserSetting component in the SolarWinds Orion Platform software-related network monitoring system is related to deficiencies in access control and insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to elevate their privilege...

The vulnerability of the ActionPluginBaseView component in the SolarWinds Orion Platform software for network monitoring allows a hacker to execute arbitrary code.

The vulnerability of the ActionPluginBaseView component in SolarWinds Orion Platform’s network monitoring software lies in the ability to restore unreliable data in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

SolarWinds Orion Platform NCM SCM IPAM SaveUserSetting Improper Access Control Privilege Escalation Vulnerability

This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SaveUserSetting endpoint. The issue results from improper restriction...