3593 matches found
CVE-2019-16957
SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account...
CVE-2019-16955
SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request...
Design/Logic Flaw
SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account...
Cross site request forgery (csrf)
SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request...
CVE-2019-16955
SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request...
CVE-2019-16955
CVE-2019-16955 affects SolarWinds Web Help Desk 12.7.0 and is a cross-site scripting (XSS) vulnerability triggered by an uploaded SVG document in a request. The root cause is improper handling of SVG uploads leading to script injection. Public documents (NVD, Red Hat, CNVD) confirm the issue; no ...
CVE-2019-16957
SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account...
CVE-2019-16957
SolarWinds Web Help Desk 12.7.0 is affected by a Cross‑Site Scripting (XSS) vulnerability that can be triggered via the First Name field of a User Account. The issue is documented in CVE-2019-16957 and is consistently described across multiple feeds (NVD, Red Hat, CNVD, CVE lists). The connected ...
Microsoft Says Its Systems Were Also Breached in Massive SolarWinds Hack
The massive state-sponsored espionage campaign that compromised software maker SolarWinds also targeted Microsoft, as the unfolding investigation into the hacking spree reveals the incident may have been far more wider in scope, sophistication, and impact than previously thought. News of...
Microsoft Says Its Systems Were Also Breached in Massive SolarWinds Hack
The massive state-sponsored espionage campaign that compromised software maker SolarWinds also targeted Microsoft, as the unfolding investigation into the hacking spree reveals the incident may have been far more wider in scope, sophistication, and impact than previously thought. News of...
CVE-2019-16957: Improper Neutralization of Input During Web Page Generation
SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account...
Solarwinds WebHelpDesk 跨站脚本漏洞
SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. A cross-site scripting vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct cross-site scripting attacks via the "name" field of a user account...
SolarWinds Orion Platform < 2020.2.1 HF2 Multiple Vulnerabilities
According to its self-reported version number, the version of SolarWinds Orion Platform is prior to 2020.2.1 hot fix 2. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability exists in the ExecuteVBScript method due to improper validation of a user-supplie...
PT-2020-9847
Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows for cross-site scripting XSS attacks via the First Name field of a User Account. This means an attacker can inject malicious scripts into the website, potentially stealing us...
Solarwinds WebHelpDesk 跨站脚本漏洞
SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. A cross-site scripting vulnerability exists in SolarWinds Web Help Desk 12.7.0. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via an SVG document uploaded in a...
PT-2020-9846
Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows for cross-site scripting XSS via an uploaded SVG document in a request. This means an attacker could potentially inject malicious scripts into the system by uploading a...
CVE-2019-16955: Improper Neutralization of Input During Web Page Generation
SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request...
Nuclear Weapons Agency Hacked in Widening Cyberattack
The Energy Department and its National Nuclear Security Administration NNSA, which is the agency that maintains the U.S. nuclear stockpile, have been compromised as part of the widespread cyberattack uncovered this week stemming from the massive SolarWinds hack. An exclusive report by Politico...
More on the SolarWinds Breach
The New York Times has more details. About 18,000 private and government users downloaded a Russian tainted software update - a Trojan horse of sorts - that gave its hackers a foothold into victims systems, according to SolarWinds, the company whose software was compromised. Among those who use...
Threat Source newsletter (Dec. 17, 2020)
Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. This will be our last Threat Source newsletter of the year. We’ll be on a few-week break for the holidays until Jan. 7. Of course, all anyone wants to talk about this week is the SolarWinds supply chain attack. There are still man...