Design/Logic Flaw

An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service SWIS. Exposed credentials are encrypted and require authenticated access with an NCM role...

SolarWinds Hybrid Cloud Observability 加密问题漏洞

SolarWinds Hybrid Cloud Observability is a U.S.-based SolarWinds company that helps organizations ensure availability and reduce remediation time across local and multi-cloud environments by improving visibility, intelligence and productivity. A security vulnerability exists in SolarWinds Hybrid...

CVE-2021-35226 Hashed Credential Exposure Vulnerability

An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service SWIS. Exposed credentials are encrypted and require authenticated access with an NCM role...

PT-2022-5000 · Solarwinds · Network Configuration Manager

Name of the Vulnerable Software and Affected Versions: Network Configuration Manager affected versions not specified Description: The issue is related to a misconfigured entity in the Network Configuration Manager product, which exposes a password field to the Solarwinds Information Service SWIS...

CVE-2021-35226

CVE-2021-35226 affects SolarWinds Network Configuration Manager (NCM). A misconfiguration in NCM exposes a password field to Solarwinds Information Service (SWIS). Exposed credentials are encrypted and require authenticated access with an NCM role. Documented impact is limited to credential expos...

CVE-2022-36965

Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform 2022.3.0...

CVE-2022-36965

Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform 2022.3.0...

Design/Logic Flaw

Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform 2022.3.0...

CVE-2022-36965 Stored and DOM XSS in QoE Applications: Orion Platform

Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform 2022.3.0...

CVE-2022-36965 Stored and DOM XSS in QoE Applications: Orion Platform

Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform 2022.3.0...

CVE-2022-36965

The CVE-2022-36965 entry concerns SolarWinds Orion Platform’s QoE application, where insufficient sanitization of inputs in the QoE input field could enable stored and DOM-based XSS. The issue is documented as fixed in SolarWinds Platform version 2022.3.0. Affected component: QoE input handling; ...

SolarWinds Network Performance Monitor UpdateActionsDescriptions SQL Injection Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor. Authentication is required to exploit this vulnerability. The specific flaw exists within the UpdateActionsDescriptions function. The issue results from the lack ...

Solarwinds Orion Platform SQL注入漏洞

Solarwinds Orion Platform is a network fault and network performance management platform from Solarwinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user comments, and a mapped view of the entire network. An...

Solarwinds Orion Platform 跨站脚本漏洞

Solarwinds Orion Platform is a network fault and network performance management platform from Solarwinds, Inc. The platform provides real-time monitoring and analysis of network devices, as well as support for customized web interfaces, multiple user comments, and a mapped view of the entire...

PT-2022-23711 · Solarwinds · Solarwinds Platform

Name of the Vulnerable Software and Affected Versions: SolarWinds Platform versions prior to 2022.3.0 Description: The issue is related to insufficient sanitization of inputs in the QoE application input field, which could lead to stored and DOM-based XSS attacks. Recommendations: For versions...

Vulnerabilities fixed in SolarWinds Orion

Vulnerabilities have been fixed in SolarWinds Orion. The vulnerabilities allow an authenticated malicious person with access to the network is able to launch attacks that lead to the following categories of damage: Cross-Site Scripting XSS. Remote code execution User Rights SQL Injection Access t...

SolarWinds Orion Platform < 2022.3 Multiple Vulnerabilities

The version of SolarWinds Orion Platform installed on the remote host is prior to 2022.3. It is, therefore, affected by multiple vulnerabilities as referenced in the solarwindsplatform20223 advisory. - A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated...

Limiting the Software Supply Chain Attack Surface

Limiting the Software Supply Chain Attack Surface By Trellix · September 21, 2022 This blog was written by Douglas McKee We often discuss how the intentions of an action matter, and it's clear to see why they do. If I am walking down the sidewalk, distracted by my phone of course and run into a...

How to Support Agile Development Through Cybersecurity Best Practices

Understanding other peoples problems It’s often said that people only notice cybersecurity when it fails, or when it gets in the way of them doing their jobs. Organizations, and especially software development teams, want to be able to develop quickly and easily to stay ahead of their competition...

SolarWinds Hackers Using New Post-Exploitation Backdoor ‘MagicWeb’

By Deeba Ahmed Microsoft has warned that the new post-compromise backdoor MagicWeb lets hackers "authenticate as anyone." This is a post from HackRead.com Read the original post: SolarWinds Hackers Using New Post-Exploitation Backdoor MagicWeb...