CVE-2020-12608

Summary (concrete details known): The vulnerability CVE-2020-12608 affects SolarWinds MSP PME (Patch Management Engine) Cache Service in the Advanced Monitoring Agent, with versions before 1.1.15. The root cause is insecure file permissions on the config directory under %PROGRAMDATA%\SolarWinds M...

CVE-2020-12608: Incorrect Default Permissions

An issue was discovered in SolarWinds MSP PME Patch Management Engine Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecure file permissions for %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.CacheService\config. This can lead to code execution by changing the...

SolarWinds MSP PME Cache Service Insecure File Permissions / Code Execution Exploit

SolarWinds MSP PME Cache Service versions prior to 1.1.15 suffer from insecure file permission and code execution vulnerabilities. Title: SolarWinds MSP PME Cache Service - Insecure File Permissions / Code Execution Author: Jens Regel, Schneider & Wulf EDV-Beratung GmbH & Co. KG GitHub:...

SolarWinds MSP PME Cache Service Insecure File Permissions / Code Execution

Title: SolarWinds MSP PME Cache Service - Insecure File Permissions / Code Execution Author: Jens Regel, Schneider & Wulf EDV-Beratung GmbH & Co. KG GitHub: https://github.com/jensregel/Advisories/tree/master/CVE-2020-12608 CVSSv3: 8.2 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVE:...

PT-2020-13167

Name of the Vulnerable Software and Affected Versions SolarWinds MSP PME Patch Management Engine Cache Service versions prior to 1.1.15 Description An issue was discovered in the SolarWinds MSP PME Cache Service, where there are insecure file permissions for the directory containing the...

SolarWinds Orion Platform Information Disclosure Vulnerability

SolarWinds Orion Platform is a network fault and network performance management platform from SolarWinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user opinions, and a mapped view of the entire network. An...

CVE-2019-12864

SolarWinds Orion Platform 2018.4 HF3 NPM 12.4, NetPath 1.1.4 is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query...

CVE-2019-12864

SolarWinds Orion Platform 2018.4 HF3 NPM 12.4, NetPath 1.1.4 is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query...

Design/Logic Flaw

SolarWinds Orion Platform 2018.4 HF3 NPM 12.4, NetPath 1.1.4 is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query...

CVE-2019-12864

SolarWinds Orion Platform 2018.4 HF3 NPM 12.4, NetPath 1.1.4 is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query...

CVE-2019-12864

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is affected by an Information Leakage vulnerability caused by improper error handling that exposes stack traces and a full pathname on a 500 Internal Server Error. The issue is demonstrated via the api2/swis/query?lang=en-us&swAlertOn...

PT-2020-9346

Name of the Vulnerable Software and Affected Versions: SolarWinds Orion Platform version 2018.4 HF3 NPM 12.4, NetPath 1.1.4 Description: The issue is related to improper error handling with stack traces, which can lead to information leakage. This can be demonstrated by discovering a full pathnam...

CVE-2019-12864: Generation of Error Message Containing Sensitive Information

SolarWinds Orion Platform 2018.4 HF3 NPM 12.4, NetPath 1.1.4 is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query...

SolarWinds WebHelpDesk Code Injection Vulnerability

SolarWinds WebHelpDesk is a suite of helpdesk and asset management software from SolarWinds USA. The software supports centralized knowledge base, IT asset management, project and task management, and more. A security vulnerability exists in the export feature in SolarWinds WebHelpDesk version...

CVE-2019-20002

Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value provided by a low-privileged user in the Subject field of a help request form that is mishandled in a TicketActions/view?tab=group TSV export by an admin user...

CVE-2019-20002

Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value provided by a low-privileged user in the Subject field of a help request form that is mishandled in a TicketActions/view?tab=group TSV export by an admin user...

Design/Logic Flaw

Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value provided by a low-privileged user in the Subject field of a help request form that is mishandled in a TicketActions/view?tab=group TSV export by an admin user...

CVE-2019-20002

Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value provided by a low-privileged user in the Subject field of a help request form that is mishandled in a TicketActions/view?tab=group TSV export by an admin user...

CVE-2019-20002

SolarWinds WebHelpDesk 12.7.1 contains a Formula Injection vulnerability in the export feature. A low-privileged user can provide a value in the Subject field of a help request form, which is mishandled during a TSV export performed by an admin user via TicketActions/view?tab=group. This leads to...

PT-2020-10315

Name of the Vulnerable Software and Affected Versions SolarWinds WebHelpDesk version 12.7.1 Description The issue exists in the export feature of SolarWinds WebHelpDesk, where a low-privileged user can inject a formula via the Subject field of a help request form. This formula is then mishandled...