110 matches found
CVE-2022-36960: Improper Authentication
SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges...
CVE-2022-36958
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands...
Solarwinds Web Help Desk 安全漏洞
SolarWinds Web Help Desk is a suite of help desk and asset management software from SolarWinds USA. The software supports features such as centralized knowledge base, IT asset management, project and task management. A security vulnerability exists in SolarWinds Web Help Desk 12.7.8 and prior...
CVE-2021-35232: Use of Hard-coded Credentials
Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users ...
CVE-2021-32076 Access Restriction bypass vulnerability via referrer spoof - Business Logic Bypass
Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTT...
CVE-2021-32076: Authentication Bypass by Spoofing
Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTT...
PT-2021-8995
Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows for XSS via a Schedule Name. Recommendations For SolarWinds Web Help Desk version 12.7.0, update to a version that fixes this issue to prevent XSS attacks. At the moment, the...
CVE-2019-16961: Improper Neutralization of Input During Web Page Generation
SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name...
CVE-2019-16954
SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...
PT-2021-8992
Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows HTML injection via a Comment in a Help Request ticket. This can potentially lead to malicious activities such as stealing user sessions or conducting phishing attacks...
CVE-2019-16954: Improper Neutralization of Input During Web Page Generation
SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...
CVE-2019-16956: Improper Neutralization of Input During Web Page Generation
SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket...
PT-2021-8993
Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows for cross-site scripting XSS attacks via the Request Type parameter of a ticket. This means an attacker could potentially inject malicious scripts into the website, affecting...
Solarwinds WebHelpDesk 跨站脚本漏洞
SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. A cross-site scripting vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct a cross-site scripting attack via a CSV template file with a specially craft...
CVE-2019-16960: Improper Neutralization of Input During Web Page Generation
SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field...
PT-2021-8994
Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows for cross-site scripting XSS attacks via a crafted CSV template file, specifically by manipulating the Location Name field. This can potentially lead to the execution of...
CVE-2019-16959
SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket...
PT-2020-9849
Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows CSV Injection, also known as Formula Injection, via a file attached to a ticket. Recommendations For SolarWinds Web Help Desk version 12.7.0, consider restricting the ability...
CVE-2019-16959: Improper Neutralization of Formula Elements in a CSV File
SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket...