CVE-2022-36960

The connected ZDI advisory (ZDI-22-1662) describes a privilege-escalation vulnerability in SolarWinds Network Performance Monitor, arising from improper input validation in the WebUserSettingsCrudHandler. The flaw hinges on lack of validation of the SettingName parameter, allowing an authenticate...

CVE-2022-36962: Improper Neutralization of Special Elements used in an OS Command

SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarWinds database to execute arbitrary commands...

CVE-2022-36964: Deserialization of Untrusted Data

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands...

CVE-2022-36960: Improper Authentication

SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges...

SolarWinds Platform 命令注入漏洞

SolarWinds Platform is a unified monitoring, observability, and service management platform from U.S.-based SolarWinds, Inc. SolarWinds Platform suffers from a command injection vulnerability that stems from susceptibility to command injection and allows a remote attacker to take full control of...

SolarWinds Platform 输入验证错误漏洞

SolarWinds Platform is a unified monitoring, observability, and service management platform from U.S.-based SolarWinds, Inc. A security vulnerability exists in SolarWinds Platform that stems from vulnerability to improper input validation and allows a remote attacker with valid access to the...

SolarWinds Platform 代码问题漏洞

SolarWinds Platform is a unified monitoring, observability, and service management platform from U.S.-based SolarWinds, Inc. A security vulnerability exists in SolarWinds Platform that stems from vulnerability to deserialization of untrustworthy data and allows a remote attacker with valid access...

SolarWinds Security Event Manager Cross-Site Scripting Vulnerability

SolarWinds Security Event Manager SolarWinds SEM is an American SolarWinds Inc. for forensics and troubleshooting, as well as a tool to help you manage log data. A cross-site scripting vulnerability exists in SolarWinds Security Event Manager versions prior to 2022.4. The vulnerability stems from...

Unspecified Vulnerability in SolarWinds Security Event Manager

SolarWinds Security Event Manager SolarWinds SEM is an American SolarWinds, Inc. for forensics and troubleshooting, as well as a tool to help you manage log data. A security vulnerability exists in SolarWinds Security Event Manager 2022.2 and prior versions that stems from disclosing HTTP methods...

SolarWinds Security Event Manager Information Disclosure Vulnerability

SolarWinds Security Event Manager SolarWinds SEM is an American SolarWinds Inc. for forensics and troubleshooting, as well as a tool to help you manage log data. An information disclosure vulnerability exists in SolarWinds Security Event Manager versions prior to 2022.4, which stems from the...

Vulnerabilities fixed in SolarWinds products

Vulnerabilities have been fixed in several SolarWinds products, including Platform and Orion. The vulnerabilities allow an authenticated malicious person able to execute arbitrary code execute under application permissions or to elevate permissions. SolarWinds has released updates to address the...

SolarWinds Security Event Manager 环境问题漏洞

SolarWinds Security Event Manager SolarWinds SEM is an American SolarWinds Inc. for forensics and troubleshooting, as well as a tool to help you manage log data. A cross-site scripting vulnerability exists in SolarWinds Security Event Manager versions prior to 2022.4. The vulnerability stems from...

PT-2022-23710 · Solarwinds · Solarwinds Platform

Name of the Vulnerable Software and Affected Versions: SolarWinds Platform affected versions not specified Description: The issue allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands due to the Deserialization of Untrusted Data. Recommendations: At t...

PT-2022-24209 · Solarwinds · Solarwinds Sem +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns an insecure method vulnerability where allowed HTTP methods are disclosed, including OPTIONS, DELETE, TRACE, and PUT. Recommendations: At the moment, there is no...

PT-2022-23709 · Solarwinds · Solarwinds Platform

Name of the Vulnerable Software and Affected Versions: SolarWinds Platform affected versions not specified Description: The issue allows a remote adversary with complete control over the SolarWinds database to execute arbitrary commands due to a Command Injection vulnerability. Recommendations: A...

SolarWinds Security Event Manager 安全漏洞

SolarWinds Security Event Manager SolarWinds SEM is an American SolarWinds, Inc. for forensics and troubleshooting, as well as a tool to help you manage log data. A security vulnerability exists in SolarWinds Security Event Manager 2022.2 and prior versions that stems from disclosing HTTP methods...

SolarWinds Security Event Manager 信息泄露漏洞

SolarWinds Security Event Manager SolarWinds SEM is an American SolarWinds Inc. for forensics and troubleshooting, as well as a tool to help you manage log data. An information disclosure vulnerability exists in SolarWinds Security Event Manager versions prior to 2022.4, which stems from the...

SolarWinds Engineer Toolset 安全漏洞

SolarWinds Engineer Toolset is a network software package from SolarWinds USA. It can help you discover, configure, monitor and troubleshoot your network. A security vulnerability exists in SolarWinds Engineer Toolset version 2020.2.6 HF4, which stems from its inability to prevent users from...

SolarWinds Serv-U 15.3.0 < 15.3.2 (deprecated)

The version of SolarWinds Serv-U installed on the remote host is prior to 15.3.2. It is, therefore, affected by a vulnerability as referenced in the serv-u1532 advisory. - This vulnerability happens in the web client of Serv-U 15.3.1 and earlier release version. When the payload is entered in the...

PT-2022-23707 · Solarwinds · Solarwinds Platform

Name of the Vulnerable Software and Affected Versions: SolarWinds Platform affected versions not specified Description: The issue is related to Improper Input Validation, allowing a remote adversary with valid access to the SolarWinds Web Console to escalate user privileges. This can be achieved...