CVE-2012-2576

SQL injection vulnerability (LoginServlet loginName field) affects SolarWinds Storage Manager before 5.1.2, Storage Profiler before 5.1.2, and Backup Profiler before 5.1.2. Remote attacker can execute arbitrary SQL commands. Root cause: unsafely constructed loginName input leading to injection. E...

CVE-2015-5371

CVE-2015-5371 concerns SolarWinds Storage Manager. The vulnerability lies in the AuthenticationFilter class, enabling an unauthenticated remote attacker to upload arbitrary scripts via unspecified vectors and execute code with SYSTEM privileges. Public references include ZDI-15-275 and related ad...

CVE-2015-7838

The CVE-2015-7838 entry concerns SolarWinds Storage Manager prior to version 6.2, where ProcessFileUpload.jsp vulnerable to remote file upload. Multiple connected sources confirm that an unauthenticated attacker can upload and execute arbitrary files via unspecified vectors, leading to remote cod...