SolarWinds Network Performance Monitor SQL Injection Vulnerability

A SQL injection vulnerability exists in SolarWinds Network Performance Monitor that stems from a database-based application that lacks validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute illegal SQL commands...

CVE-2020-27870

This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1. Authentication is required to exploit this vulnerability. The specific flaw exists within ExportToPDF.aspx. The issue results from the lack of proper...

CVE-2020-27871

This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within...

CVE-2020-27871

This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within...

Design/Logic Flaw

This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within...

CVE-2020-27871

This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within...

CVE-2020-27871

CVE-2020-27871 affects SolarWinds Orion Platform 2020.2.1, describing an Arbitrary File Write via VulnerabilitySettings.aspx caused by insufficient validation of a user-supplied path in file operations. The vulnerability allows remote attackers to create arbitrary files and, per sources, could en...

CVE-2020-27870

SolarWinds Orion Platform 2020.2.1 is affected by a path-traversal vulnerability in ExportToPDF.aspx. The issue stems from insufficient validation of a user-supplied path before file operations, enabling an authenticated attacker to disclose information in the SYSTEM context. Mitigation: SolarWin...

CVE-2020-27870

This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1. Authentication is required to exploit this vulnerability. The specific flaw exists within ExportToPDF.aspx. The issue results from the lack of proper...

Solarwinds SolarWinds Orion Platform 路径遍历漏洞

SolarWinds Orion Platform is a network fault and network performance management platform from SolarWinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user opinions, and a mapped view of the entire network. A...

Solarwinds SolarWinds Orion Platform 路径遍历漏洞

SolarWinds Orion Platform is a network fault and network performance management platform from SolarWinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user opinions, and a mapped view of the entire network. A...

SolarWinds Orion Platform < 2020.2.4 Multiple Vulnerabilities

According to its self-reported version number, the version of SolarWinds Orion Platform is prior to 2020.2.4. It is, therefore, affected by multiple vulnerabilities: - The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ Microsoft Message Queue and doesn't set permissions ...

SolarWinds Orion Platform < 2019.4.2 Remote Code Execution

The Collector Service in SolarWinds Orion Platform before 2019.4.2 uses MSMQ Microsoft Message Queue and doesn't set permissions on its private queues. As a result, remote unauthenticated clients can send messages to TCP port 1801 that the Collector Service will process. Additionally, upon...

Serv-U FTP Server < 15.2.2 Hotfix 1 Arbitrary File Read/Write

In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files that include users' password hashes that is world readable and writable. An unprivileged Windows user having access to the server's filesystem can add an FTP user by copying a valid profile file to thi...

SonicWall Zero-Day

Hackers are exploiting a zero-day in SonicWall: In an email, an NCC Group spokeswoman wrote: "Our team has observed signs of an attempted exploitation of a vulnerabilitythat affects the SonicWall SMA 100 series devices. We are working closely with SonicWall to investigate this in more depth." In...

Industrial Networks See Sharp Uptick in Hackable Security Holes

It’s on: Adversaries, CISOs and researchers are all simultaneously involved in a frantic race to find cybersecurity vulnerabilities hiding within industrial networks, according to the latest Biannual ICS Risk and Vulnerability report from Claroty. The report analyzed all publicly disclosed...

SolarWinds Serv-U FTP Server Cross-Site Scripting Vulnerability (CNVD-2021-14805)

SolarWinds Serv-U FTP Server is a set of U.S. SolarWinds FTP and MFT file transfer software. A cross-site scripting vulnerability exists in SolarWinds Serv-U before 15.2.2, which allows reflection of XSS via authentication.No detailed vulnerability details are available at this time...

SolarWinds Orion Platform Access Control Error Vulnerability

SolarWinds Orion Platform is a network fault and network performance management platform from Solarwinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user opinions, and a mapped view of the entire network. An...

SolarWinds Serv-U File Server Cross-Site Scripting Vulnerability (CNVD-2021-14808)

Solarwinds SolarWinds Serv-U File Server is a file transfer server from SolarWinds USA. A cross-site scripting vulnerability exists in SolarWinds Serv-U File Server before 15.2.2, which stems from a WEB application lacking proper authentication of client data. An authenticated attacker could...

SolarWinds Orion Platform Code Execution Vulnerability

Solarwinds Orion Platform is a network fault and network performance management platform from Solarwinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user opinions, and a mapped view of the entire network. A...