CVSS: 9.0EPSS: 5%CPEs: 2EXPL: 0CVE-2020-14005 – SolarWinds Network Performance Monitor ExecuteVBScript Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-14005
24 Jun 2020 — Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code via a defined event. Solarwinds Orion (con Web Console WPM versión 2019.4.1 y Orion Platform HF4 o NPM HF2 versión 2019.4), permite a atacantes remotos ejecutar código arbitrario por medio de un evento definido This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor. Authentication is requ... • https://gist.github.com/alert3/c9dcce5474e55f408c93c086c30cdbb7 •
CVSS: 5.4EPSS: 1%CPEs: 2EXPL: 1CVE-2020-14006
https://notcve.org/view.php?id=CVE-2020-14006
24 Jun 2020 — Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a Responsible Team. Solarwinds Orion (con Web Console WPM versión 2019.4.1 y Orion Platform HF4 o NPM HF2 versión 2019.4), permite un ataque de tipo XSS por medio de un Equipo Responsable • https://gist.github.com/alert3/f8d33412ab0c671d3cac6a50b132a894 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 1%CPEs: 2EXPL: 1CVE-2020-14007
https://notcve.org/view.php?id=CVE-2020-14007
24 Jun 2020 — Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a name of an alert definition. Solarwinds Orion (con Web Console WPM versión 2019.4.1 y Orion Platform HF4 o NPM HF2 versión 2019.4), permite un ataque de tipo XSS por medio del nombre de una definición de alerta • https://gist.github.com/alert3/f8d33412ab0c671d3cac6a50b132a894 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2019-12864
https://notcve.org/view.php?id=CVE-2019-12864
04 May 2020 — SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query parameter. Orion Platform versión 2018.4 HF3 de SolarWinds (NPM versión 12.4, NetPath versión 1.1.4), es vulnerable a una Filtración de Información, debido al manejo inapropiado de errores con rastros de pila, como ... • https://www.esecforte.com/network-performance-monitor-india-esec-forte-technologies • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 4.8EPSS: 1%CPEs: 3EXPL: 1CVE-2019-12863
https://notcve.org/view.php?id=CVE-2019-12863
25 Feb 2020 — SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen. SolarWinds Orion Platform versión 2018.4 HF3 (NPM versión 12.4, NetPath versión 1.1.4), permite una inyección HTML Almacenada por los administradores por medio de la pantalla Web Console Settings. • https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-12863-stored-html-injection-vulnerability-in-solarwinds-orion-platform-2018-4-hf3-npm-12-4-netpath-1-1-4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 2%CPEs: 2EXPL: 1CVE-2019-12954
https://notcve.org/view.php?id=CVE-2019-12954
17 Feb 2020 — SolarWinds Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) allows XSS by authenticated users via a crafted onerror attribute of a VIDEO element in an action for an ALERT. SolarWinds Network Performance Monitor (Orion Platform 2018, NPM versión 12.3, NetPath versión 1.1.3), permite un ataque de tipo XSS por parte de usuarios autenticados mediante un atributo onerror diseñado de un elemento de VIDEO en una acción para una ALERTA. • https://www.esecforte.com/cve-2019-12954-solarwinds-network-performance-monitor-orion-platform-2018-npm-12-3-netpath-1-1-3-vulnerable-for-stored-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 45%CPEs: 1EXPL: 0CVE-2019-8917
https://notcve.org/view.php?id=CVE-2019-8917
18 Feb 2019 — SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote, unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method may be abused by an attacker to execute commands as the SYSTEM user. SolarWinds Orion NPM, en versiones anteriores a la 12.4, sufre de una vulnerabilidad de ejecución remota de código "SYSTEM" en el servicio OrionModu... • http://www.securityfocus.com/bid/107061 •
CVSS: 8.8EPSS: 78%CPEs: 8EXPL: 7CVE-2014-9566 – SolarWinds Orion Service - SQL Injection
https://notcve.org/view.php?id=CVE-2014-9566
03 Mar 2015 — Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor (NPM) before 11.5, NetFlow Traffic Analyzer (NTA) before 4.1, Network Configuration Manager (NCM) before 7.3.2, IP Address Manager (IPAM) before 4.3, User Device Tracker (UDT) before 3.2, VoIP & Network Quality Manager (VNQM) before 4.2, Server & Application Manager (SAM) before 6.2, Web Performance Monitor (WPM) before 2.2, ... • https://packetstorm.news/files/id/180603 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 1%CPEs: 10EXPL: 2CVE-2012-4939 – SolarWinds Orion IP Address Manager (IPAM) - 'search.aspx' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-4939
31 Oct 2012 — Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the "Search for an IP address" field. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la IPAMSummaryView.aspx en el interfaz web IPAM anterior a v3.0-HotFix1 en SolarWinds Orion Network Performance Monitor puede permitir a un atacante remoto inyect... • https://www.exploit-db.com/exploits/37995 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 7%CPEs: 2EXPL: 3CVE-2012-2602 – SolarWinds Orion Network Performance Monitor 10.2.2 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-2602
12 Aug 2012 — Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts via CreateUserStepContainer actions to Admin/Accounts/Add/OrionAccount.aspx or (2) modify account privileges via a ynAdminRights action to Admin/Accounts/EditAccount.aspx. Múltiples vulnerabilidades de falsificación de peticiones en sitios cruzados (CSRF) en SolarWinds Or... • https://www.exploit-db.com/exploits/20011 • CWE-352: Cross-Site Request Forgery (CSRF) •