CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-35242 – A valid CSRF token is present in response to an invalid request
https://notcve.org/view.php?id=CVE-2021-35242
Serv-U server responds with valid CSRFToken when the request contains only Session. El servidor Serv-U responde con un CSRFToken válido cuando la petición contiene sólo Session • https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-2-5_release_notes.htm https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35242 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.4EPSS: 0%CPEs: 4EXPL: 0CVE-2021-35245 – Broken Access Control Vulnerability for SolarWinds Serv-U
https://notcve.org/view.php?id=CVE-2021-35245
When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine. Cuando un usuario presenta derechos de administrador en la Consola de Serv-U, el usuario puede mover, crear y eliminar cualquier archivo al que se pueda acceder en la máquina anfitriona de Serv-U • https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-2-5_release_notes.htm https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35245 • CWE-284: Improper Access Control •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-35237 – Clickjacking Vulnerability
https://notcve.org/view.php?id=CVE-2021-35237
A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server. This is an attack on both the user and the server. Un encabezado HTTP faltante (X-Frame-Options) en Kiwi Syslog Server ha dejado a clientes vulnerables al clickjacking. • https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35237 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-35236 – Missing Secure Flag From SSL Cookie
https://notcve.org/view.php?id=CVE-2021-35236
The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP, there is a potential for the cookie can be sent in clear text. El indicador de seguridad no está establecido en la cookie SSL de Kiwi Syslog Server 9.7.2 y versiones anteriores. • https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35236 • CWE-311: Missing Encryption of Sensitive Data CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-35235 – ASP.NET Debug Feature Enabled
https://notcve.org/view.php?id=CVE-2021-35235
The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if configured to do so. Debug mode causes ASP.NET to compile applications with extra information. The information enables a debugger to closely monitor and control the execution of an application. If an attacker could successfully start a remote debugging session, this is likely to disclose sensitive information about the web application and supporting infrastructure that may be valuable in targeting SWI with malicious intent. • https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35235 • CWE-11: ASP.NET Misconfiguration: Creating Debug Binary •