Multiple SolarWinds Products SQL Injection Vulnerabilities

SolarWinds Storage Manager, SolarWinds Storage Profiler and SolarWinds Backup Profiler are all products of SolarWinds, Inc. SolarWinds Storage Manager is a web-based data storage management software that integrates storage monitoring, reporting, alarming and predictive analytics, etc. Storage...

Sql injection

SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backup Profiler before 5.1.2 allows remote attackers to execute arbitrary SQL commands via the loginName field...

CVE-2012-2576

SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backup Profiler before 5.1.2 allows remote attackers to execute arbitrary SQL commands via the loginName field...

CVE-2012-2576

SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backup Profiler before 5.1.2 allows remote attackers to execute arbitrary SQL commands via the loginName field...

CVE-2012-2576

SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backup Profiler before 5.1.2 allows remote attackers to execute arbitrary SQL commands via the loginName field...

CVE-2012-2576

SQL injection vulnerability (LoginServlet loginName field) affects SolarWinds Storage Manager before 5.1.2, Storage Profiler before 5.1.2, and Backup Profiler before 5.1.2. Remote attacker can execute arbitrary SQL commands. Root cause: unsafely constructed loginName input leading to injection. E...

The vulnerability of the restrictssh function in the SolarWinds Log & Event Manager software allows a malicious actor to execute commands with root privileges.

The vulnerability of the restrictssh function in the SolarWinds Log & Event Manager software management tool is related to the lack of measures taken to protect data at the administrative level. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions, gain higher...

SolarWinds Orion NPM 12.0.15300.90 Multiple Vulnerabilities

SolarWinds Orion NPM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

demo.solarwinds.com XSS vulnerability

Open Bug Bounty ID: OBB-385675 Description| Value ---|--- Affected Website:| demo.solarwinds.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...

SolarWinds Network Performance Monitor Cross-Site Scripting Vulnerability

SolarWinds Network Performance Monitor NPM is a network performance monitor from SolarWinds, Inc. that provides monitoring and reporting, tracking of up/down status, real-time analytics, and network performance statistics for routers, virtualized environments, and other devices. A cross-site...

SolarWinds Network Performance Monitor Denial of Service Vulnerability

SolarWinds Network Performance Monitor NPM is a network performance monitor from SolarWinds, Inc. that provides monitoring and reporting, tracking of up/down status, real-time analytics, and network performance statistics for routers, virtualized environments, and other devices. A security...

SolarWinds Log and Event Manager < 6.3.1 Hotfix 4 Insecure HTTP Update Download MitM Code Execution

According to its self-reported version number, the SolarWinds Log and Event Manager installed on the remote host is prior to version 6.3.1 Hotfix 4. It is, therefore, affected by a vulnerability in the software update process. Software updates are packaged and delivered insecurely, leading to roo...

CVE-2017-9538

The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cause a denial of service permanent display of a "Cannot exit above the top directory" error message throughout the entire web application via a ".." in the pat...

CVE-2017-9537

Persistent cross-site scripting XSS in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to introduce arbitrary JavaScript into various vulnerable parameters...

CVE-2017-9538

The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cause a denial of service permanent display of a "Cannot exit above the top directory" error message throughout the entire web application via a ".." in the pat...

CVE-2017-9537

Persistent cross-site scripting XSS in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to introduce arbitrary JavaScript into various vulnerable parameters...

Directory traversal

The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cause a denial of service permanent display of a "Cannot exit above the top directory" error message throughout the entire web application via a ".." in the pat...

Cross site scripting

Persistent cross-site scripting XSS in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to introduce arbitrary JavaScript into various vulnerable parameters...

CVE-2017-9538

SolarWinds Network Performance Monitor 12.0.15300.90 is affected by a directory-traversal vulnerability in the Upload logo from external path function. A remote attacker can supply a path containing leading .. sequences to trigger a denial-of-service condition that results in a persistent error m...

CVE-2017-9537

SolarWinds Network Performance Monitor 12.0.15300.90 is affected by CVE-2017-9537 (and related records) due to a persistent XSS in the Add Node function. An attacker can inject arbitrary JavaScript into multiple vulnerable parameters (e.g., City, Comments, Department) during node-adding workflows...