CVSS: 6.4EPSS: 1%CPEs: 2EXPL: 0CVE-2021-35225 – Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5
https://notcve.org/view.php?id=CVE-2021-35225
21 Oct 2021 — Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination. Cada usuario autenticado de Orion Platform en un entorno MSP (Managed Service Provider) puede visualizar y navegar todos los servicios NetPath de todos los clientes de ese MSP. Esto puede conllevar a que cualquier usuario ten... • https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm •
CVSS: 10.0EPSS: 53%CPEs: 1EXPL: 0CVE-2021-31474 – SolarWinds Network Performance Monitor FromJson Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-31474
21 May 2021 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 2020.2.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SolarWinds.Serialization library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. • https://documentation.solarwinds.com/en/success_center/sam/content/release_notes/sam_2020-2-5_release_notes.htm • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.0EPSS: 65%CPEs: 2EXPL: 0CVE-2020-27869 – SolarWinds Network Performance Monitor WriteToFile SQL Injection Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-27869
11 Feb 2021 — This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor 2020 HF1, NPM: 2020.2. Authentication is required to exploit this vulnerability. The specific flaw exists within the WriteToFile method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges and reset the password for the Admin user. • https://www.zerodayinitiative.com/advisories/ZDI-21-064 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 5%CPEs: 2EXPL: 0CVE-2020-14005 – SolarWinds Network Performance Monitor ExecuteVBScript Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-14005
24 Jun 2020 — Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code via a defined event. Solarwinds Orion (con Web Console WPM versión 2019.4.1 y Orion Platform HF4 o NPM HF2 versión 2019.4), permite a atacantes remotos ejecutar código arbitrario por medio de un evento definido This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor. Authentication is requ... • https://gist.github.com/alert3/c9dcce5474e55f408c93c086c30cdbb7 •
CVSS: 5.4EPSS: 1%CPEs: 2EXPL: 1CVE-2020-14006
https://notcve.org/view.php?id=CVE-2020-14006
24 Jun 2020 — Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a Responsible Team. Solarwinds Orion (con Web Console WPM versión 2019.4.1 y Orion Platform HF4 o NPM HF2 versión 2019.4), permite un ataque de tipo XSS por medio de un Equipo Responsable • https://gist.github.com/alert3/f8d33412ab0c671d3cac6a50b132a894 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 1%CPEs: 2EXPL: 1CVE-2020-14007
https://notcve.org/view.php?id=CVE-2020-14007
24 Jun 2020 — Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a name of an alert definition. Solarwinds Orion (con Web Console WPM versión 2019.4.1 y Orion Platform HF4 o NPM HF2 versión 2019.4), permite un ataque de tipo XSS por medio del nombre de una definición de alerta • https://gist.github.com/alert3/f8d33412ab0c671d3cac6a50b132a894 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2019-12864
https://notcve.org/view.php?id=CVE-2019-12864
04 May 2020 — SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query parameter. Orion Platform versión 2018.4 HF3 de SolarWinds (NPM versión 12.4, NetPath versión 1.1.4), es vulnerable a una Filtración de Información, debido al manejo inapropiado de errores con rastros de pila, como ... • https://www.esecforte.com/network-performance-monitor-india-esec-forte-technologies • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 4.8EPSS: 1%CPEs: 3EXPL: 1CVE-2019-12863
https://notcve.org/view.php?id=CVE-2019-12863
25 Feb 2020 — SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen. SolarWinds Orion Platform versión 2018.4 HF3 (NPM versión 12.4, NetPath versión 1.1.4), permite una inyección HTML Almacenada por los administradores por medio de la pantalla Web Console Settings. • https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-12863-stored-html-injection-vulnerability-in-solarwinds-orion-platform-2018-4-hf3-npm-12-4-netpath-1-1-4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 2%CPEs: 2EXPL: 1CVE-2019-12954
https://notcve.org/view.php?id=CVE-2019-12954
17 Feb 2020 — SolarWinds Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) allows XSS by authenticated users via a crafted onerror attribute of a VIDEO element in an action for an ALERT. SolarWinds Network Performance Monitor (Orion Platform 2018, NPM versión 12.3, NetPath versión 1.1.3), permite un ataque de tipo XSS por parte de usuarios autenticados mediante un atributo onerror diseñado de un elemento de VIDEO en una acción para una ALERTA. • https://www.esecforte.com/cve-2019-12954-solarwinds-network-performance-monitor-orion-platform-2018-npm-12-3-netpath-1-1-3-vulnerable-for-stored-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-13442
https://notcve.org/view.php?id=CVE-2018-13442
16 Jul 2019 — SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter. Network Performance Monitor versión 12.3 de SolarWinds, permite la inyección SQL por medio del parámetro TriggeringObjectEntityNames del archivo /api/ActiveAlertsOnThisEntity/GetActiveAlerts. • https://labs.nettitude.com/blog/cve-2018-13442-solarwinds-npm-sql-injection • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •