CVE-2015-5371

The AuthenticationFilter class in SolarWinds Storage Manager allows remote attackers to upload and execute arbitrary scripts via unspecified vectors...

Authentication flaw

The AuthenticationFilter class in SolarWinds Storage Manager allows remote attackers to upload and execute arbitrary scripts via unspecified vectors...

CVE-2015-5371

CVE-2015-5371 concerns SolarWinds Storage Manager. The vulnerability lies in the AuthenticationFilter class, enabling an unauthenticated remote attacker to upload arbitrary scripts via unspecified vectors and execute code with SYSTEM privileges. Public references include ZDI-15-275 and related ad...

CVE-2015-5371

The AuthenticationFilter class in SolarWinds Storage Manager allows remote attackers to upload and execute arbitrary scripts via unspecified vectors...

(0Day) SolarWinds Storage Manager AuthenticationFilter Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SolarWinds Storage Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AuthenticationFilter class. The issue lies in the ability to subvert th...

Solarwinds Firewall Security Manager Detection

Detection of Solarwinds Firewall Security Manager The script sends a connection request to the server and attempts to detect Solarwinds Firewall Security Manager FSM. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C...

Solarwinds FSM RCE Vulnerability

Solarwinds Firewall Security Manager is prone to a remote code execution RCE vulnerability SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE ...

The vulnerability of the distributed network access control device of SolarWinds Firewall Security Manager allows a hacker to elevate their privileges and execute arbitrary code within the client session.

The vulnerability of the userlogin.jsp module in the SolarWinds Firewall Security Manager distributed network access control system allows a malicious actor to escalate their privileges and execute arbitrary code within the client session...

SolarWinds Network Performance Monitor 'ReturnUrl' Open Redirect Vulnerability

Network Performance Monitor NPM is a comprehensive monitoring and fault management software that monitors and collects data from routers, switches, servers and other SNMP devices. A security vulnerability exists in SolarWinds Network Performance Monitor 'ReturnUrl' because the program fails to...

SolarWinds Orion Multiple SQLi Vulnerabilities

The remote host is running a version of SolarWinds Orion Core that is affected by multiple blind SQL injection vulnerabilities in the 'AccountManagement.asmx' script. A remote attacker, after being authenticated using the built-in default 'Guest' account, can exploit these vulnerabilities to...

SolarWinds Network Performance Monitor Open Redirect

Affected software: SolarWinds Network Performance Monitor Type of vulnerability:url redirection URL:http://www.solarwinds.com/ Discovered by: provensec Website: provensec.com version:N/A Proof of concept http://oriondemo.solarwinds.com/Orion/Login.aspx?ReturnUrl=//google.com...

SolarWinds Orion GetAccountGroups Multiple SQL Injections (CVE-2014-9566)

Multiple SQL injection vulnerabilities have been reported in SolarWinds products. These vulnerabilities are due to insufficient validation of certain parameters when processed by GetAccountGroups. Remote attackers could exploit this vulnerability by sending HTTP requests with a crafted dir or sor...

Multiple SolarWinds Orion GetAccounts SQL Injections (CVE-2014-9566)

Multiple SQL injection vulnerabilities have been reported in SolarWinds products. These vulnerabilities are due to insufficient validation of certain parameters when processed by GetAccounts. Remote attackers could exploit this vulnerability by sending HTTP requests with a crafted dir or sort...

SolarWinds Firewall Security Manager 6.6.5 - Client Session Handling (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability", 'Description' = %q This module exploits multiple...

SolarWinds Server and Application Monitor loadExtensionFactory Stack Buffer Overflow (CVE-2015-1500)

A stack buffer overflow vulnerability exists in SolarWinds Server and Application Monitor. The vulnerability is due to insufficient validation in loadExtensionFactory method of a 'factory' object. A remote unauthenticated attacker can exploit the vulnerability by enticing a target user to visit a...

Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Exploit

This Metasploit module exploits multiple vulnerabilities found in Solarwinds Firewall Security Manager 6.6.5. The first vulnerability is an authentication bypass via the Change Advisor interface due to a user-controlled session.putValue API in userlogin.jsp, allowing the attacker to set the...

Solarwinds Firewall Security Manager 6.6.5 Client Session Handling

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability", 'Description' = %q This module exploits multiple...

SolarWinds Server and Application Monitor loadExtensionFactory Code Execution (CVE-2015-1501)

A code execution vulnerability exists in SolarWind Server and Application Monitor. A remote unauthenticated attacker can exploit the vulnerability by enticing a target user to visit a malicious website. Successful exploitation could allow arbitrary code execution within security context of the...

SolarWinds Firewall Security Manager userlogin.jsp Policy Bypass (CVE-2015-2284)

A policy bypass vulnerability exists in SolarWinds Firewall Security Manager. The vulnerability is due to a design weakness in the userlogin.jsp page which sets the "username" session value to a user supplied value prior to authentication. A remote unauthenticated attacker could exploit this...

CVE-2015-2284

userlogin.jsp in SolarWinds Firewall Security Manager FSM before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling...