CVE-2020-15909

SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take...

CVE-2020-15910

SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be...

CVE-2020-15909

SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take...

CVE-2020-15910

SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be...

Session fixation

SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take...

Design/Logic Flaw

SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be...

CVE-2020-15909

SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take...

CVE-2020-15910

SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be...

CVE-2020-15909

SolarWinds N-central up to 2020.1 is described as vulnerable to session hijacking via the JSESSIONID cookie. The JSESSIONID attribute is not validated against multiple sources (e.g., source IP, MFA claims) while the victim remains logged in, allowing an attacker to steal the cookie and reuse it b...

CVE-2020-15910

This CVE concerns SolarWinds N-Central, affected in version 12.3 GA and lower. The underlying issue is that the JSESSIONID cookie is not marked HttpOnly, enabling client-side scripts to influence or exfiltrate the cookie. The described impact is that an attacker could lure a user to a crafted pag...

PT-2020-14707

Name of the Vulnerable Software and Affected Versions SolarWinds N-Central versions prior to 12.3 GA Description The issue allows an attacker to influence the cookie with JavaScript, potentially extracting the JSESSIONID. This could be achieved by sending the user to a prepared webpage or by...

CVE-2020-15910: Incorrect Permission Assignment for Critical Resource

SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be...

PT-2020-14706

Name of the Vulnerable Software and Affected Versions SolarWinds N-central versions through 2020.1 Description The issue allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources, such as sourceip o...

CVE-2020-15909: Session Fixation

SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take...

SolarWinds Orion Platform Cross-Site Scripting Vulnerability (CNVD-2020-52937)

SolarWinds Orion Platform is a network fault and network performance management platform from SolarWinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user opinions, and a mapped view of the entire network. A...

CVE-2020-13169

Stored XSS Cross-Site Scripting exists in the SolarWinds Orion Platform before before 2020.2.1 on multiple forms and pages. This vulnerability may lead to the Information Disclosure and Escalation of Privileges takeover of administrator account...

CVE-2020-13169

Stored XSS Cross-Site Scripting exists in the SolarWinds Orion Platform before before 2020.2.1 on multiple forms and pages. This vulnerability may lead to the Information Disclosure and Escalation of Privileges takeover of administrator account...

Cross site scripting

Stored XSS Cross-Site Scripting exists in the SolarWinds Orion Platform before before 2020.2.1 on multiple forms and pages. This vulnerability may lead to the Information Disclosure and Escalation of Privileges takeover of administrator account...

CVE-2020-13169

Stored XSS Cross-Site Scripting exists in the SolarWinds Orion Platform before before 2020.2.1 on multiple forms and pages. This vulnerability may lead to the Information Disclosure and Escalation of Privileges takeover of administrator account...

CVE-2020-13169

SolarWinds Orion Platform is affected by a stored XSS vulnerability (CVE-2020-13169) in versions before 2020.2.1 on multiple forms/pages. The root cause is improper validation/returning of unsanitized user input, enabling an attacker–hosted page to execute script in a user’s browser, potentially ...