Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation Exploit

This module exploits a stacked SQL injection in order to add an administrator user to the SolarWinds Orion database. Usage Info msf use auxiliary/gather/solarwindsorionsqli msf auxiliarysolarwindsorionsqli show actions ...actions... msf auxiliarysolarwindsorionsqli set ACTION msf...

Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation

This module exploits a stacked SQL injection in order to add an administrator user to the SolarWinds Orion database. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Solarwinds Orion...

NASA Orion (Mars) Filter Bypass / Persistent Cross Site Scripting

Document Title: =============== NASA Orion - Bypass, Persistent Issue & Embed Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1339 VU666988 US CERT Vulnerability Magazine:...

NASA Orion - Bypass, Persistent Issue & Embed Code Exec

Document Title: =============== NASA Orion - Bypass, Persistent Issue & Embed Code Exec References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1339 VU666988 US CERT Vulnerability Magazine:...

NASA Orion - Bypass, Persistent Issue & Embed Code Exec

Document Title: =============== NASA Orion - Bypass, Persistent Issue & Embed Code Exec References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1339 VU666988 US CERT Vulnerability Magazine:...

solarwinds orion network performance monitor 10.2.2 - Multiple Vulnerabilities

No description provided by source. / Exploit Title: SolarWinds Orion Network Performance Monitor 10.2.2 Multiple Vulnerabilities Date: Jul 21 2012 Author: muts Version: SolarWinds Orion Network Performance Monitor 10.2.2 Vendor URL: http://www.solarwinds.com/ Timeline: 29 May 2012: Vulnerability...

Master of Orion III <= 1.2.5 - Denial of Service Exploit

No description provided by source. / by Luigi Auriemma / include stdio.h include stdlib.h include string.h ifdef WIN32 include winsock.h / Header file used for manage errors in Windows It support socket and errno too this header replace the previous sockerrX.h / include string.h include errno.h...

Quicksilver Master of Orion III 1.2.5 - Multiple Remote Denial of Service Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/11550/info Master of Orion III is reported prone to multiple remote denial of service vulnerabilities. These issues occur because the application does not handle exceptional conditions in a proper manner. Master of Orion...

Orion Application Server <= 2.0.7 Terminal Escape Sequence in Logs Command Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/37717/info Orion Application Server is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles. Attackers can exploit this issue to execute arbitrary commands in ...

SolarWinds Orion NPM < 10.7 Multiple Vulnerabilities

The remote web server hosts a version of SolarWinds Orion NPM prior to version 10.7. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the 'wpdlx' ActiveX control where the application fails to validate file types when loading or saving images. This can allow a...

CVE-2013-2821

NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier allow remote attackers to cause a denial of service driver crash and process restart via a crafted DNP3 TCP packet...

CVE-2013-2822

NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier allow physically proximate attackers to cause a denial of service driver crash and process restart via crafted input...

CVE-2013-2822

NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier allow physically proximate attackers to cause a denial of service driver crash and process restart via crafted input...

CVE-2013-2822

NovaTech Orion Substation Automation Platform (OrionLX: Master 1.27.38 / Slave 1.23.10 and earlier; Orion5/Orion5r Master 1.27.38 / Slave 1.23.10 and earlier) contains a denial-of-service vulnerability when processing crafted input over a serial line, causing the Orion driver to crash and the pro...

CVE-2013-2821

NovaTech Orion Substation Automation Platform (OrionLX DNP Master 1.27.38 / DNP Slave 1.23.10 and Orion5/Orion5r 1.27.38 / 1.23.10 and earlier) contains an improper input validation vulnerability in the DNP3 implementation that can cause the Orion Process to restart (driver crash) when processing...

SolarWinds Orion Pepco32c ActiveX Control Buffer Overflow

A heap-based buffer overflow vulnerability exists in SolarWinds Orion Server and Application Monitor. The vulnerability is due to insufficient bounds checking specific parameter of the Pepco32c control. A remote unauthenticated attacker can exploit this vulnerability by enticing a user to visit a...

SolarWinds Orion IPAM Reflected Cross-site Scripting (CVE-2012-4939)

A reflected cross-site scripting vulnerability exists in SolarWinds Orion IPAM. The vulnerability is due to insufficient sanitization of user-supplied input, which is echoed back to the user. A remote attacker could exploit this vulnerability by enticing an authenticated user to follow a crafted...

SolarWinds Orion NPM < 9.5 Login.asp SQLi

The remote web server hosts a version of SolarWinds Orion NPM that has a deprecated 'Login.asp' script that is accessible and contains a blind SQL injection vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Cross site scripting

Cross-site scripting XSS vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the "Search for an IP address" field...

CVE-2012-4939

Cross-site scripting XSS vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the "Search for an IP address" field...