CVSS: 6.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-35219 – ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-35219
ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page. Una Vulnerabilidad de Divulgación de Información de Lectura Arbitraria de Archivos en ExportToPdfCmd, mediante la función ImportAlert en la página Alerts Settings • https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-ExportToPdfCmd-Arbitrary-File-Read-Information-Disclosure-CVE-2021-35219?language=en_US https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35219 •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32076 – Access Restriction bypass vulnerability via referrer spoof - Business Logic Bypass
https://notcve.org/view.php?id=CVE-2021-32076
Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback. En SolarWinds Web Help Desk versión 12.7.2, se ha detectado una Omisión de Restricciones de Acceso por medio de una suplantación de referencias. Un atacante puede acceder a "Web Help Desk Getting Started Wizard", especialmente a la página de creación de la cuenta de administrador, desde un rango de red de direcciones IP sin privilegios o una dirección de loopback al interceptar la petición HTTP y cambiando el referrer de la dirección IP pública al loopback • https://exchange.xforce.ibmcloud.com/vulnerabilities/208278 https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076 • CWE-290: Authentication Bypass by Spoofing •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28674
https://notcve.org/view.php?id=CVE-2021-28674
The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) via an account with write permissions. This occurs because node IDs are predictable (with incrementing numbers) and the access control on Services/NodeManagement.asmx/DeleteObjNow is incorrect. To exploit this, an attacker must be authenticated and must have node management rights associated with at least one valid group on the platform. La página de administración de nodos en SolarWinds Orion Platform versiones anteriores a 2020.2.5 HF1, permite a un atacante crear o eliminar un nodo (fuera del perímetro del atacante) por medio de una cuenta con permisos de escritura. Esto ocurre porque los IDs de los nodos son predecibles (con números crecientes) y el control de acceso en Services/NodeManagement.asmx/DeleteObjNow es incorrecto. • https://pastebin.com/zFUd2cCj https://www.solarwinds.com/trust-center/security-advisories/cve-2021-28674 • CWE-330: Use of Insufficiently Random Values CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 95%CPEs: 3EXPL: 3CVE-2021-35211 – SolarWinds Serv-U Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-35211
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability. Microsoft descubrió una vulnerabilidad de ejecución de código remota (RCE) en el producto SolarWinds Serv-U usando una Vulnerabilidad de Escape de Memoria Remota. Si es explotado, un actor de la amenaza puede ser capaz de obtener acceso privilegiado a la máquina que aloja Serv-U solamente. • https://github.com/BishopFox/CVE-2021-35211 https://github.com/NattiSamson/Serv-U-CVE-2021-35211 https://github.com/0xhaggis/CVE-2021-35211 https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211 • CWE-787: Out-of-bounds Write •
CVSS: 9.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-31217
https://notcve.org/view.php?id=CVE-2021-31217
In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM. En SolarWinds DameWare Mini Remote Control Server versión 12.0.1.200, unos permisos de archivo no seguro permiten la eliminación de archivos como SYSTEM • https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_12-2_release_notes.htm https://support.solarwinds.com/SuccessCenter/s • CWE-276: Incorrect Default Permissions •