CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 3CVE-2012-2602 – SolarWinds Orion Network Performance Monitor 10.2.2 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-2602
Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts via CreateUserStepContainer actions to Admin/Accounts/Add/OrionAccount.aspx or (2) modify account privileges via a ynAdminRights action to Admin/Accounts/EditAccount.aspx. Múltiples vulnerabilidades de falsificación de peticiones en sitios cruzados (CSRF) en SolarWinds Orion Network Performance Monitor (NPM) antes de v10.3.1 permiten a atacantes remotos secuestrar la autentificación de los administradores para las peticiones que (1) crean cuentas de usuario a través de acciones CreateUserStepContainer a Admin/Cuentas/Agregar/OrionAccount.aspx o (2) modifican los privilegios de una cuenta a través de una acción ynAdminRights a Admin/accounts/EditAccount.aspx. • https://www.exploit-db.com/exploits/20011 http://osvdb.org/84116 http://secunia.com/advisories/50004 http://www.exploit-db.com/exploits/20011 http://www.kb.cert.org/vuls/id/174119 http://www.securityfocus.com/bid/54624 http://www.solarwinds.com/documentation/Orion/docs/ReleaseNotes/releaseNotes.htm • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 2CVE-2012-2577 – SolarWinds Orion Network Performance Monitor 10.2.2 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-2577
Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName field of an snmpd.conf file. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en SolarWinds Orion Network Performance Monitor (NPM) anterior a v10.3.1 permite a atacantes remotos inyectar código web arbitrario o html a través de (1) syslocation, (2) syscontact, o (3) el campo sysName de un fichero snmpd.conf. • https://www.exploit-db.com/exploits/20011 http://secunia.com/advisories/50004 http://www.kb.cert.org/vuls/id/174119 http://www.securityfocus.com/bid/54624 http://www.solarwinds.com/documentation/Orion/docs/ReleaseNotes/releaseNotes.htm https://exchange.xforce.ibmcloud.com/vulnerabilities/77147 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2010-4828
https://notcve.org/view.php?id=CVE-2010-4828
Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) 10.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Title parameter to MapView.aspx; NetObject parameter to (2) NodeDetails.aspx and (3) InterfaceDetails.aspx; and the (4) ChartName parameter to CustomChart.aspx. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en SolarWinds Orion Network Performance Monitor (NPM) v10.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro (1) Title de MapView.aspx; el parámetro NetObject (2) de NodeDetails.aspx y (3) InterfaceDetails.aspx, y el parámetro ChartName (4) de CustomChart.aspx. • http://secunia.com/advisories/42486 http://securityreason.com/securityalert/8349 http://www.securityfocus.com/archive/1/515083/100/0/threaded http://www.securityfocus.com/bid/45257 https://exchange.xforce.ibmcloud.com/vulnerabilities/63956 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •