CVE-2019-17125

CVE-2019-17125 concerns a Reflected Client‑Side Template Injection (CSTI) in SolarWinds Orion Platform 2019.2 HF1. The CSTI arises via Angular expressions that attackers can inject to escape the Angular sandbox, enabling stored XSS across multiple input vectors within the Orion Web UI. The NVD en...

orion-astro.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1048938 Security Researcher Nep13371998 Helped patch 562 vulnerabilities Received 4 Coordinated Disclosure badges Received 7 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting orion-astro.com website...

SolarWinds Orion NPM OrionModuleEngine Remote Code Execution (CVE-2019-8917)

A remote code execution vulnerability exists in SolarWinds Orion NPM. This vulnerability is due to missing access controls in the InvokeActionMethod method. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

CVE-2018-20999

An issue was discovered in the orion crate before 0.11.2 for Rust. reset calls cause incorrect results...

CVE-2018-20999

An issue was discovered in the orion crate before 0.11.2 for Rust. reset calls cause incorrect results...

Input validation

An issue was discovered in the orion crate before 0.11.2 for Rust. reset calls cause incorrect results...

CVE-2018-20999

CVE-2018-20999 affects the Rust crate orion (before version 0.11.2). The issue arises from reset() calls that can produce incorrect results by mishandling streaming state. The root cause is that the state could be reset without ensuring proper finalization, leading to corrupted streaming state an...

CVE-2018-20999

An issue was discovered in the orion crate before 0.11.2 for Rust. reset calls cause incorrect results...

BADministration - Tool Which Interfaces with Management or Administration Applications from an Offensive Standpoint

BADministration is a tool which interfaces with management or administration applications from an offensive standpoint. It attempts to provide offsec personnel a tool with the ability to identify and leverage these non-technical vulnerabilities. As always: use for good, promote security, and figh...

SolarWinds Orion Platform Elevation of Privilege Vulnerability

SolarWinds Orion Platform is a network fault and network performance management platform from SolarWinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user opinions, and a mapped view of the entire network. A...

Design/Logic Flaw

SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service...

CVE-2019-9546

SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service...

CVE-2019-9546

SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service...

CVE-2019-9546

SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service...

CVE-2019-9546

SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

SolarWinds Orion Network Performance Monitor Privilege Permission and Access Control Issues Vulnerability

SolarWinds Orion Network Performance Monitor NPM is a network performance monitor from SolarWinds USA. It provides monitoring and reporting, tracking of up/down status, real-time analysis and network performance statistics for routers, virtualized environments and other devices. A security...

SolarWinds Orion Network Performance Monitor (NPM) Detection Consolidation

Consolidation of SolarWinds Orion Network Performance Monitor NPM detections. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2019-8917

SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote, unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method ma...

Remote code execution

SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote, unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method ma...

CVE-2019-8917

SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote, unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method ma...