SolarWinds Serv-U 15.2.0 < 15.2.3

The version of SolarWinds Serv-U installed on the remote host is prior to 15.2.2 HF1. It is, therefore, affected by a vulnerability as referenced in the serv-u1522hf1 advisory. - In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files that include users'...

SolarWinds Serv-U 15.2.4 < 15.2.5 Multiple Vulnerabilities

The version of SolarWinds Serv-U installed on the remote host is prior to 15.2.5. It is, therefore, affected by multiple vulnerabilities as referenced in the serv-u1525 advisory. - Serv-U server responds with valid CSRFToken when the request contains only Session. CVE-2021-35242 - When a user has...

SolarWinds Serv-U 15.2.0 < 15.2.3 XSS

The version of SolarWinds Serv-U installed on the remote host is prior to 15.2.3. It is, therefore, affected by a vulnerability as referenced in the serv-u1523 advisory. - Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka Share URL...

SolarWinds Serv-U 15.0 < 15.3.1

The version of SolarWinds Serv-U installed on the remote host is prior to 15.3.1. It is, therefore, affected by a vulnerability as referenced in the serv-u1531 advisory. - This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of...

SolarWinds Serv-U 15.3.1

The version of SolarWinds Serv-U installed on the remote host is prior to 15.3 HF1. It is, therefore, affected by a vulnerability as referenced in the serv-u153hf1 advisory. - A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to th...

Exploit for Use of Hard-coded Credentials in Solarwinds Web_Help_Desk

CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential...

SolarWinds ARM 2024.3.1 Multiple Vulnerabilities (2024-3-1)

The version of SolarWinds ARM installed on the remote host is prior to 2024.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 2024-3-1 advisory. - SolarWinds Access Rights Manager ARM was found to contain a hard-coded credential authentication bypass vulnerability. ...

SolarWinds Issues Patch for Critical ARM Vulnerability Enabling RCE Attacks

SolarWinds has released fixes to address two security flaws in its Access Rights Manager ARM software, including a critical vulnerability that could result in remote code execution. The vulnerability, tracked as CVE-2024-28991, is rated 9.0 out of a maximum of 10.0 on the CVSS scoring system. It...

The vulnerability of the SolarWinds Access Rights Manager software, which stems from the use of strictly encrypted credentials, allows a perpetrator to gain access to the RabbitMQ management console.

The vulnerability of the SolarWinds Access Rights Manager ARM lies in the use of strictly encrypted credentials. Exploiting this vulnerability could allow a malicious actor to gain access to the RabbitMQ management console remotely...

Vulnerabilities fixed in Solarwinds Access Rights Manager

Solarwinds has fixed vulnerabilities in Access Rights Manager. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges and execute arbitrary code with application privileges. Solarwinds has released updates to fix the vulnerabilities. See attached references f...

SolarWinds Access Rights Manager JsonSerializationBinder Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Access Rights Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

SolarWinds Access Rights Manager Hard-Coded Credentials Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of a RabbitMQ instance. The issue results from the use...

The vulnerability of the SolarWinds Access Rights Manager software, related to defects in the deserialization mechanism, allows a perpetrator to execute arbitrary code.

The vulnerability of the SolarWinds Access Rights Manager software-related access control tool is related to deficiencies in its deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2024-28990

SolarWinds Access Rights Manager ARM was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability would allow access to the RabbitMQ management console. We thank Trend Micro Zero Day Initiative ZDI for its ongoing partnership in coordinating...

CVE-2024-28991

SolarWinds Access Rights Manager ARM was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution...

CVE-2024-28990

SolarWinds Access Rights Manager ARM was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability would allow access to the RabbitMQ management console. We thank Trend Micro Zero Day Initiative ZDI for its ongoing partnership in coordinating...

CVE-2024-28991

SolarWinds Access Rights Manager ARM was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution...

CVE-2024-28991 SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution

SolarWinds Access Rights Manager ARM was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution...

CVE-2024-28991 SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution

SolarWinds Access Rights Manager ARM was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution...

CVE-2024-28991

SolarWinds ARM is affected by a remote code execution vulnerability (CVE-2024-28991) tied to the JsonSerializationBinder deserialization pathway. The issue allows an authenticated user to exploit ARM to execute arbitrary code on the server; authentication is required, but the vulnerability can be...