Exploit for Missing Authentication for Critical Function in Solarwinds Orion_Platform

Usage & Disclaimer This script is a batch detection script f...

Latest on the SVR’s SolarWinds Hack

The New York Times has an in-depth article on the latest information about the SolarWinds hack not a great name, since its much more far-reaching than that. Interviews with key players investigating what intelligence agencies believe to be an operation by Russia’s S.V.R. intelligence service...

SolarWinds Web Help Desk Cross-Site Scripting Vulnerability (CNVD-2021-01529)

SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. A cross-site scripting vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct a cross-site scripting attack via a CSV template file with a specially craft...

Technical Deep Dive Into SolarWinds Breach

Many organizations have been compromised by the recent SolarWinds breach, which seems to be a targeted attack against both government and private agencies. The complete scale of this attack is still unknown, but what is known is that the hackers gained access to victims’ systems via malicious...

A week in security (December 28 – January 3)

First off we would like to wish all our readers a happy and secure 2021! Last week on Malwarebytes Labs we presented an overview of developments in the SearchDimension hijackers, we looked at the most enticing cyberattacks of 2020, and we also looked back at the strangest cybersecurity events of...

CVE-2019-16960

SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field...

CVE-2019-16956

SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket...

CVE-2019-16960

SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field...

Design/Logic Flaw

SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field...

Cross site request forgery (csrf)

SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket...

CVE-2019-16960

SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field...

CVE-2019-16960

SolarWinds Web Help Desk 12.7.0 is affected by a cross-site scripting (XSS) vulnerability that can be triggered via a crafted CSV template file, using a manipulated Location Name field. The connected Red Hat and CNVD entries corroborate the vulnerability description and refer to the same CVE-2019...

CVE-2019-16956

SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket...

CVE-2019-16956

SolarWinds Web Help Desk 12.7.0 is affected by a Cross‑Site Scripting (XSS) vulnerability exploitable via the Request Type parameter in a ticket. The connected sources confirm the affected product and vulnerability class but do not provide exploit details, affected versions beyond 12.7.0, or a re...

PT-2021-8994

Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows for cross-site scripting XSS attacks via a crafted CSV template file, specifically by manipulating the Location Name field. This can potentially lead to the execution of...

CVE-2019-16960: Improper Neutralization of Input During Web Page Generation

SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field...

CVE-2019-16956: Improper Neutralization of Input During Web Page Generation

SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket...

PT-2021-8993

Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows for cross-site scripting XSS attacks via the Request Type parameter of a ticket. This means an attacker could potentially inject malicious scripts into the website, affecting...

SolarWinds Web Help Desk 跨站脚本漏洞

Solarwinds Web Help Desk is a suite of help desk and asset management software from Solarwinds USA. The software supports centralized knowledge base, IT asset management, project and task management, and more. A cross-site scripting vulnerability exists in SolarWinds Web Help Desk 12.7.0 that...

Solarwinds WebHelpDesk 跨站脚本漏洞

SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. A cross-site scripting vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct a cross-site scripting attack via a CSV template file with a specially craft...