CVE-2023-35187

CVE-2023-35187 affects SolarWinds Access Rights Manager. The OpenClientUpdateFile method contains a path validation flaw that allows an unauthenticated attacker to perform directory traversal and achieve remote code execution on affected installations. The vulnerability enables code execution wit...

CVE-2024-23476

CVE-2024-23476 refers to a Directory Traversal Remote Code Execution vulnerability in SolarWinds Access Rights Manager (ARM). The accessible documents describe an unauthenticated path-traversal flaw that can lead to remote code execution with high impact (CVE metrics show a CRITICAL base score, 9...

CVE-2024-23469

SolarWinds ARM contains a Remote Code Execution vulnerability tied to the EndUpdate exposed dangerous method. The flaw allows an unauthenticated attacker to execute code with SYSTEM privileges on affected installations. Nessus notes pre-2024.3 ARM versions are affected; the 2024.3 update (release...

CVE-2024-23466

SolarWinds ARM is affected by CVE-2024-23466, a Directory Traversal Remote Code Execution vulnerability in the Connect method. An unauthenticated attacker can perform file operations and execute code with SYSTEM privileges. Affected context includes SolarWinds Access Rights Manager (ARM) prior to...

CVE-2024-23472

CVE-2024-23472 relates to SolarWinds Access Rights Manager (ARM). The issue is a Directory Traversal vulnerability that allows an authenticated user to arbitrarily read and delete files in ARM. The vulnerability is confirmed across multiple sources in the connected documents, and related advisori...

CVE-2024-23479

SolarWinds ARM is affected by CVE-2024-23479: a Directory Traversal Remote Code Execution vulnerability. The issue allows an unauthenticated attacker to achieve remote code execution via directory traversal in ARM. The vulnerability affects SolarWinds Access Rights Manager; however, the provided ...

CVE-2024-28074

The CVE-2024-28074 entry concerns SolarWinds Access Rights Manager (ARM) with an Internal Deserialization Remote Code Execution vulnerability. Connected sources indicate that ARM versions prior to 2024.3 are affected due to unsafe deserialization processing of serialized data, enabling an attacke...

CVE-2024-23465

CVE-2024-23465 concerns SolarWinds Access Rights Manager (ARM). The vulnerability is an authentication bypass that could let an unauthenticated user gain domain administrator access within Active Directory. Several sources corroborate the issue and its impact (high severity, AR attack vector). Pu...

CVE-2024-23470

CVE-2024-23470 affects SolarWinds Access Rights Manager (ARM). A pre-authentication remote code execution vulnerability is described as an exposed dangerous method in the UserScriptHumster component, allowing an unauthenticated user to run commands/executables on the server. Related Nessus data c...

CVE-2023-35182

CVE-2023-35182 affects SolarWinds Access Rights Manager. The flaw is a deserialization of untrusted data in createGlobalServerChannelInternal, enabling unauthenticated remote code execution with SYSTEM privileges on affected ARM installations. NVD notes a CRITICAL/HIGH impact (CVSSv3.1 base score...

CVE-2023-35185

CVE-2023-35185 concerns SolarWinds Access Rights Manager OpenFile Directory Traversal leading to remote code execution. The connected ZDI advisory specifies that the vulnerability exists in the OpenFile method and stems from insufficient validation of a user-supplied path prior to file operations...

CVE-2024-23475

CVE-2024-23475 affects SolarWinds Access Rights Manager (ARM). The vulnerability is a Directory Traversal and Information Disclosure flaw that could allow an unauthenticated attacker to delete arbitrary files and leak sensitive information via path traversal in ARM. Root cause details across conn...

CVE-2024-23467

CVE-2024-23467 affects SolarWinds Access Rights Manager (ARM). The vulnerability is a Directory Traversal and Information Disclosure flaw that, according to the sources, could allow an unauthenticated attacker to perform remote code execution and access sensitive data. The issue is noted in multi...

CVE-2024-23478

CVE-2024-23478 affects SolarWinds Access Rights Manager (ARM). The connected advisories describe a deserialization/JsonSerializationBinder flaw that can allow an attacker to trigger remote code execution in ARM installations. The ZDI advisory specifies that authentication is required and attribut...

CVE-2024-23477

CVE-2024-23477 affects SolarWinds Access Rights Manager (ARM). The vulnerability is a Directory Traversal that enables unauthenticated remote code execution. Details across sources indicate exposed components (openServerFileStream) and that exploitability does not have published fix/version infor...

CVE-2024-23468

CVE-2024-23468 affects SolarWinds Access Rights Manager (ARM). The vulnerability is a Directory Traversal and Information Disclosure flaw that allows an unauthenticated attacker to delete arbitrary files and leak sensitive information. Root cause involves improper restrictions in file handling (e...

CVE-2024-23474

CVE-2024-23474 affects SolarWinds Access Rights Manager (ARM). The issue is a Directory Traversal/Arbitrary File Deletion vulnerability in ARM that could leak information and allow deletion of arbitrary files. Exploitation could impact confidentiality, integrity, and availability (per NVD and acc...

CVE-2024-28992

SolarWinds Access Rights Manager (ARM) is affected by CVE-2024-28992: a Directory Traversal and Information Disclosure vulnerability. The issue allows an unauthenticated attacker to delete arbitrary files and leak sensitive information. Connected sources corroborate this vulnerability across mult...

CVE-2024-23471

SolarWinds ARM (Access Rights Manager) is affected by CVE-2024-23471, a CreateFile Directory Traversal vulnerability leading to Remote Code Execution. The issue is triggered by an authenticated user abusing a SolarWinds service to execute code with elevated privileges. Nessus/NVD entries describe...

CVE-2023-35184

The CVE-2023-35184 entry concerns SolarWinds Access Rights Manager and a Remote Code Execution vulnerability. Multiple connected sources confirm a deserialization/ExecuteAction flaw that can lead to code execution on affected installations. The NVD describes it as unauthenticated remote code exec...

CVE-2024-28990

SolarWinds ARM contains a hard-coded credential authentication bypass (CVE-2024-28990) that could allow access to the RabbitMQ management console. The vulnerability affects ARM versions prior to 2024.3.1, and remediation is available in ARM 2024.3.1 (as referenced by multiple sources). No exploit...

CVE-2024-28993

The CVE-2024-28993 entry concerns SolarWinds Access Rights Manager and describes a Directory Traversal and Information Disclosure vulnerability. An unauthenticated attacker could delete arbitrary files and leak sensitive information via this path traversal flaw. Multiple external sources (NVD/Red...

CVE-2024-28991

SolarWinds ARM is affected by a remote code execution vulnerability (CVE-2024-28991) tied to the JsonSerializationBinder deserialization pathway. The issue allows an authenticated user to exploit ARM to execute arbitrary code on the server; authentication is required, but the vulnerability can be...

CVE-2023-35183

The CVE-2023-35183 entry concerns SolarWinds Access Rights Manager. A local-privilege-escalation flaw exists due to incorrect default permissions on a file created by the product installer. An attacker who can run low-privilege code on a target system can escalate privileges to SYSTEM, leveraging...

CVE-2023-40058

CVE-2023-40058 relates to SolarWinds Access Rights Manager (ARM). The connected ZDI advisory documents a vulnerability in ARM that enables remote attackers to bypass authentication through misconfigurations in a RabbitMQ instance, specifically due to hard-coded credentials. This flaw allows unaut...

CVE-2023-35181

CVE-2023-35181 affects SolarWinds Access Rights Manager. The vulnerability is a Local Privilege Escalation caused by incorrect permissions on product installer-created folders, enabling an attacker with low privileges to escalate to SYSTEM. No public exploit details or patch info are provided in ...

CVE-2023-35186

SolarWinds Access Rights Manager is affected by a deserialization-based remote code execution vulnerability. The flaw exists in GetParameterFormTemplateWithSelectionState and allows an authenticated attacker to execute arbitrary code in the service context by supplying crafted data. Several trust...

CVE-2023-35180

The CVE-2023-35180 entry concerns SolarWinds Access Rights Manager (ARM). Multiple connected sources describe a Remote Code Execution vulnerability rooted in deserialization of untrusted data via the ARM API, specifically through the IFormTemplate mechanism. The flaw permits authenticated users t...

CVE-2021-35227

CVE-2021-35227 affects SolarWinds ARM with RabbitMQ Plugin on version 2020.2.6, where the HTTP interface was enabled and HTTPS configuration was unavailable. The issue arises from exposing an HTTP management interface without HTTPS configuration. CVSS data in sources show a high impact (CVSS3.1 b...

CVE-2024-28075

Summary: CVE-2024-28075 affects SolarWinds Access Rights Manager (ARM). The connected ZDI advisory and Nessus plugin confirm a deserialization flaw in the JsonSerializationBinder class that allows an authenticated, potentially bypassing authentication, attacker to execute arbitrary code on affect...

CVE-2023-40057

The vulnerability CVE-2023-40057 affects SolarWinds Access Rights Manager (ARM). Multiple connected sources describe a deserialization-based flaw that enables remote code execution when exploited by an authenticated user who abuses a SolarWinds service. The threat hinges on a Remote Code Executio...

CVE-2024-23473

CVE-2024-23473 affects SolarWinds Access Rights Manager (ARM). The connected documents describe a hard-coded credential authentication bypass that allows remote access to the RabbitMQ management console. The vulnerability arises from the RabbitMQ configuration using hard-coded credentials, enabli...