PT-2022-28066 · Solarwinds · Hybrid Cloud Observability +1

Name of the Vulnerable Software and Affected Versions: Hybrid Cloud Observability HCO/ SolarWinds Platform version 2022.4 Description: Sensitive information was stored in plain text in a file that is accessible by a user with a local account. Recommendations: For Hybrid Cloud Observability HCO/...

SolarWinds Serv-U FTP Server 授权问题漏洞

SolarWinds Serv-U FTP Server is a suite of FTP and MFT file transfer software from the U.S. company SolarWinds. SolarWinds Serv-U FTP Server suffers from an authorization issue vulnerability that stems from the deployment of a common encryption key across all of its instances resulting in an...

SolarWinds Serv-U File Server 跨站脚本漏洞

SolarWinds Serv-U File Server is a file transfer server from SolarWinds USA. A security vulnerability exists in SolarWinds Serv-U File Server versions 15.3.0 through 15.3.1 that originates from affecting the directory creation feature...

CVE-2022-36960

SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges...

CVE-2022-36962

SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarWinds database to execute arbitrary commands...

CVE-2022-36962

SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarWinds database to execute arbitrary commands...

CVE-2022-36964

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands...

CVE-2022-36960

SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges...

CVE-2022-36964

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands...

Command injection

SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarWinds database to execute arbitrary commands...

Input validation

SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges...

Deserialization of untrusted data

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands...

CVE-2022-36964

CVE-2022-36964 involves a deserialization vulnerability in SolarWinds Platform (Orion Platform) that can allow a remote attacker with valid access to the SolarWinds Web Console to execute arbitrary commands. Technical details across connected sources indicate the issue arises from deserializing u...

CVE-2022-36964 SolarWinds Platform Deserialization of Untrusted Data

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands...

CVE-2022-36964 SolarWinds Platform Deserialization of Untrusted Data

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands...

CVE-2022-36962 SolarWinds Platform Command Injection

SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarWinds database to execute arbitrary commands...

CVE-2022-36962 SolarWinds Platform Command Injection

SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarWinds database to execute arbitrary commands...

CVE-2022-36962

CVE-2022-36962 affects SolarWinds Platform and is a Command Injection vulnerability. The vulnerability allows a remote adversary who has control over the SolarWinds database to execute arbitrary commands with high impact (confidentiality, integrity, and availability) and requires network access w...

CVE-2022-36960

The connected ZDI advisory (ZDI-22-1662) describes a privilege-escalation vulnerability in SolarWinds Network Performance Monitor, arising from improper input validation in the WebUserSettingsCrudHandler. The flaw hinges on lack of validation of the SettingName parameter, allowing an authenticate...

CVE-2022-36960 SolarWinds Platform Improper Input Validation

SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges...