CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-17127
https://notcve.org/view.php?id=CVE-2019-17127
17 Jan 2020 — A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation. Se detectó una Stored Client Side Template Injection (CSTI) con Angular en SolarWinds Orion Platform versión 2019.2 HF1 en muchos formularios de aplicación. Un atacante puede inyectar una expresión de Angular y escapar del sandb... • https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2019-4-Hotfix-3?ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1&r=116&ui-knowledge-components-aura-actions.KnowledgeArticleVersionCreateDraftFromOnlineAction.createDraftFromOnlineArticle=1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-17125
https://notcve.org/view.php?id=CVE-2019-17125
17 Jan 2020 — A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. Se detectó una Reflected Client Side Template Injection (CSTI) con Angular en la plataforma SolarWinds Orion versión 2019.2 HF1 en muchos formularios. Un atacante puede inyectar una expresión de Angular y escapar del sandbox de Angular para lograr un ataque de tipo XSS almace... • https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2019-4-Hotfix-3?ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1&r=116&ui-knowledge-components-aura-actions.KnowledgeArticleVersionCreateDraftFromOnlineAction.createDraftFromOnlineArticle=1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-9546
https://notcve.org/view.php?id=CVE-2019-9546
01 Mar 2019 — SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service. SolarWinds Orion Platform, en versiones anteriores a la 2018.4 Hotfix 2, permite el escalado de privilegios mediante el servicio RabbitMQ. • https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-005.md • CWE-427: Uncontrolled Search Path Element •