PT-2018-13751

Name of the Vulnerable Software and Affected Versions SolarWinds SFTP/SCP Server versions prior to 2018-09-10 Description The configuration file of the affected software is world readable and writable, storing user passwords insecurely. This allows an attacker to determine passwords for potential...

PT-2018-13752

Name of the Vulnerable Software and Affected Versions SolarWinds SFTP/SCP server through 2018-09-10 Description The issue allows an attacker to exploit a world-readable and writable configuration file, leading to XXE XML External Entity vulnerability. This vulnerability enables an attacker to...

CVE-2018-16792: Improper Restriction of XML External Entity Reference

SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data...

CVE-2018-16791: Insufficiently Protected Credentials

In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an insecure manner, allowing an attacker to determine passwords for potentially privileged accounts. This also grants the attacker an ability to backdoor the serve...