SolarWinds Orion NPM < 10.7 Multiple Vulnerabilities

The remote web server hosts a version of SolarWinds Orion NPM prior to version 10.7. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the 'wpdlx' ActiveX control where the application fails to validate file types when loading or saving images. This can allow a...

CVE-2013-2821

NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier allow remote attackers to cause a denial of service driver crash and process restart via a crafted DNP3 TCP packet...

CVE-2013-2822

NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier allow physically proximate attackers to cause a denial of service driver crash and process restart via crafted input...

CVE-2013-2821

NovaTech Orion Substation Automation Platform (OrionLX DNP Master 1.27.38 / DNP Slave 1.23.10 and Orion5/Orion5r 1.27.38 / 1.23.10 and earlier) contains an improper input validation vulnerability in the DNP3 implementation that can cause the Orion Process to restart (driver crash) when processing...

CVE-2013-2822

NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier allow physically proximate attackers to cause a denial of service driver crash and process restart via crafted input...

CVE-2013-2822

NovaTech Orion Substation Automation Platform (OrionLX: Master 1.27.38 / Slave 1.23.10 and earlier; Orion5/Orion5r Master 1.27.38 / Slave 1.23.10 and earlier) contains a denial-of-service vulnerability when processing crafted input over a serial line, causing the Orion driver to crash and the pro...

SolarWinds Orion Pepco32c ActiveX Control Buffer Overflow

A heap-based buffer overflow vulnerability exists in SolarWinds Orion Server and Application Monitor. The vulnerability is due to insufficient bounds checking specific parameter of the Pepco32c control. A remote unauthenticated attacker can exploit this vulnerability by enticing a user to visit a...

SolarWinds Orion IPAM Reflected Cross-site Scripting (CVE-2012-4939)

A reflected cross-site scripting vulnerability exists in SolarWinds Orion IPAM. The vulnerability is due to insufficient sanitization of user-supplied input, which is echoed back to the user. A remote attacker could exploit this vulnerability by enticing an authenticated user to follow a crafted...

SolarWinds Orion NPM < 9.5 Login.asp SQLi

The remote web server hosts a version of SolarWinds Orion NPM that has a deprecated 'Login.asp' script that is accessible and contains a blind SQL injection vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Cross site scripting

Cross-site scripting XSS vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the "Search for an IP address" field...

CVE-2012-4939

Cross-site scripting XSS vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the "Search for an IP address" field...

SolarWinds Orion IPAM web interface reflected xss vulnerability

Overview SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability. ...

SolarWinds Orion Product Detection

A SolarWinds Orion product is running on the remote web server. Orion is a core component of several network monitoring and management applications. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid62117; scriptversion"1.18";...

SolarWinds Orion NPM < 10.3.1 Multiple Vulnerabilities

The remote web server hosts a version of SolarWinds Orion NPM prior to 10.3.1. It is, therefore, affected by the following vulnerabilities : - Multiple cross-site scripting vulnerabilities exist that allow arbitrary web scripts to be injected via the 'syslocation', 'syscontact', or 'sysName' fiel...

CVE-2012-2602

Multiple cross-site request forgery CSRF vulnerabilities in SolarWinds Orion Network Performance Monitor NPM before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that 1 create user accounts via CreateUserStepContainer actions to...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in SolarWinds Orion Network Performance Monitor NPM before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that 1 create user accounts via CreateUserStepContainer actions to...

CVE-2012-2602

CVE-2012-2602 affects SolarWinds Orion Network Performance Monitor (NPM) prior to 10.3.1, enabling CSRF attacks that can hijack administrator sessions to: (1) create new user accounts via CreateUserStepContainer on Admin/Accounts/Add/OrionAccount.aspx and (2) modify account privileges via a ynAdm...

CVE-2012-2577

SolarWinds Orion NPM versions prior to 10.3.1 are affected by CVE-2012-2577 due to multiple XSS vulnerabilities that allow injection via the syslocation, syscontact, or sysName fields in snmpd.conf. Connected sources (NVD and Nessus NASL) corroborate that SolarWinds Orion NPM

CVE-2012-2602

Multiple cross-site request forgery CSRF vulnerabilities in SolarWinds Orion Network Performance Monitor NPM before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that 1 create user accounts via CreateUserStepContainer actions to...

CVE-2012-2577

Multiple cross-site scripting XSS vulnerabilities in SolarWinds Orion Network Performance Monitor NPM before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 syslocation, 2 syscontact, or 3 sysName field of an snmpd.conf file...