CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-17125
https://notcve.org/view.php?id=CVE-2019-17125
A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. Se detectó una Reflected Client Side Template Injection (CSTI) con Angular en la plataforma SolarWinds Orion versión 2019.2 HF1 en muchos formularios. Un atacante puede inyectar una expresión de Angular y escapar del sandbox de Angular para lograr un ataque de tipo XSS almacenado. • https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2019-4-Hotfix-3?ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1&r=116&ui-knowledge-components-aura-actions.KnowledgeArticleVersionCreateDraftFromOnlineAction.createDraftFromOnlineArticle=1 https://support.solarwinds.com/SuccessCenter/s/orion-platform • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19829 – Serv-U FTP Server 15.1.7 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2019-19829
A cross-site scripting (XSS) vulnerability exists in SolarWinds Serv-U FTP Server 15.1.7 in the email parameter, a different vulnerability than CVE-2018-19934 and CVE-2019-13182. Se presenta una vulnerabilidad de tipo cross-site scripting (XSS) en SolarWinds Serv-U FTP Server versión 15.1.7 en el parámetro email, una vulnerabilidad diferente de CVE-2018-19934 y CVE-2019-13182. Serv-U FTP Server version 15.1.7 suffers from a persistent cross site scripting vulnerability leveraging the Email parameter. • http://packetstormsecurity.com/files/155708/Serv-U-FTP-Server-15.1.7-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13181 – Serv-U FTP Server 15.1.7 CSV Injection
https://notcve.org/view.php?id=CVE-2019-13181
A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7. Se presenta una vulnerabilidad de inyección CSV en la Interfaz de Usuario web de SolarWinds Serv-U FTP Server versión v15.1.7. Serv-U FTP Server version 15.1.7 suffers from a CSV injection vulnerability. • http://packetstormsecurity.com/files/155673/Serv-U-FTP-Server-15.1.7-CSV-Injection.html http://seclists.org/fulldisclosure/2019/Dec/33 https://www.themissinglink.com.au/security-advisories-cve-2019-13181 • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 5.4EPSS: 1%CPEs: 1EXPL: 0CVE-2019-13182 – Serv-U FTP Server 15.1.7 Persistent Cross Site Scripting
https://notcve.org/view.php?id=CVE-2019-13182
A stored cross-site scripting (XSS) vulnerability exists in the web UI of SolarWinds Serv-U FTP Server 15.1.7. Se presenta una vulnerabilidad de tipo cross-site scripting (XSS) almacenado en la Interfaz de Usuario web de SolarWinds Serv-U FTP versión 15.1.7. Serv-U FTP Server version 15.1.7 suffers from a persistent cross site scripting vulnerability. • http://packetstormsecurity.com/files/155672/Serv-U-FTP-Server-15.1.7-Persistent-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2019/Dec/32 https://www.themissinglink.com.au/security-advisories-cve-2019-13182 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 3CVE-2019-3980
https://notcve.org/view.php?id=CVE-2019-3980
The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host. An unauthenticated, remote attacker can request smart card login and upload and execute an arbitrary executable run under the Local System account. El agente Solarwinds Dameware Mini Remote Client versión v12.1.0.89, admite la autenticación con tarjeta inteligente lo que puede permitir a un usuario cargar un ejecutable para ser ejecutado en el host de DWRCS.exe. Un atacante remoto no autenticado puede solicitar el inicio de sesión con tarjeta inteligente y cargar y ejecutar una corrida de un ejecutable arbitraria bajo la cuenta Local System. • https://github.com/warferik/CVE-2019-3980 https://github.com/Barbarisch/CVE-2019-3980 https://www.tenable.com/security/research/tra-2019-43 https://www.tenable.com/security/research/tra-227-43 • CWE-346: Origin Validation Error •