Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 347

Export CSV
CVE-2024-45710

SolarWinds Platform Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

SolarWinds Platform is susceptible to an Uncontrolled Search Path Element Local Privilege Escalation vulnerability. This requires a low privilege account and local access to the affected node machine.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Solarwinds Platform
CVE-2023-40060

2FA/MFA Bypass Vulnerability in Serv-U 15.4 and 15.4 Hotfix 1

A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action. 15.4.  SolarWinds found that the issue was not completely fixed in 15.4 Hotfix 1. 

CVSS 3.1 · 7.2 High EPSS 1.0% KEV · Not listed
Vendors
Solarwinds
Products
Serv-u
CVE-2023-23840

SolarWinds Platform Exposed Dangerous Method Vulnerability

The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges.

CVSS 3.1 · 6.8 Medium EPSS 5.4% KEV · Not listed
Vendors
Solarwinds
Products
Orion Platform
CVE-2023-23845

SolarWinds Platform Exposed Dangerous Method Vulnerability

The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges.

CVSS 3.1 · 6.8 Medium EPSS 5.4% KEV · Not listed
Vendors
Solarwinds
Products
Orion Platform
CVE-2024-28989

SolarWinds Web Help Desk Cryptographic Key Management Vulnerability

SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive information from the software.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Web Help Desk
CVE-2024-52606

SolarWinds Platform Server-Side Request Forgery Vulnerability

SolarWinds Platform is affected by server-side request forgery vulnerability. Proper input sanitation was not applied allowing for the possibility of a malicious web request.

CVSS 3.1 · 3.5 Low EPSS 2.5% KEV · Not listed
Vendors
Solarwinds
Products
Solarwinds Platform
CVE-2024-52611

SolarWinds Platform Information Disclosure Vulnerability

The SolarWinds Platform is vulnerable to an information disclosure vulnerability through an error message. While the data does not provide anything sensitive, the information could assist an attacker in other malicious actions.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Solarwinds Platform
CVE-2024-45709

SolarWinds Web Help Desk Local File Read Vulnerability

SolarWinds Web Help Desk was susceptible to a local file read vulnerability. This vulnerability requires the software be installed on Linux and configured to use non-default development/test mode making exposure to the vulnerability very limited.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Web Help Desk
CVE-2024-45713

SolarWinds Kiwi CatTools Sensitive Information Disclosure Vulnerability

SolarWinds Kiwi CatTools is susceptible to a sensitive data disclosure vulnerability when a non-default setting has been enabled for troubleshooting purposes.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Kiwi Cattools
CVE-2024-28072

Arbitrary File Overwrite Vulnerability

A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Serv-u
CVE-2024-29000

SolarWinds Platform Reflected XSS Vulnerability

The SolarWinds Platform was determined to be affected by a reflected cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Solarwinds Platform
CVE-2024-28075

SolarWinds ARM Deserialization of Untrusted Data Remote Code Execution

The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.

CVSS 3.1 · 9 Critical EPSS 78.0% KEV · Not listed
Vendors
Solarwinds
Products
Access Rights Manager
CVE-2024-23473

SolarWinds Access Rights Manager (ARM) Hard-Coded Credentials Authentication Bypass Vulnerability

The SolarWinds Access Rights Manager was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability allows access to the RabbitMQ management console. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.

CVSS 3.1 · 8.6 High EPSS 1.1% KEV · Not listed
Vendors
Solarwinds
Products
Access Rights Manager
CVE-2024-29003

SolarWinds Platform Cross Site Scripting Vulnerability

The SolarWinds Platform was susceptible to a XSS vulnerability that affects the maps section of the user interface. This vulnerability requires authentication and requires user interaction.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Solarwinds Platform
CVE-2024-29001

SolarWinds Platform SWQL Injection Vulnerability

A SolarWinds Platform SWQL Injection Vulnerability was identified in the user interface. This vulnerability requires authentication and user interaction to be exploited.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Solarwinds Platform
CVE-2024-28076

SolarWinds Platform Arbitrary Open Redirection Vulnerability

The SolarWinds Platform was susceptible to a Arbitrary Open Redirection Vulnerability. A potential attacker can redirect to different domain when using URL parameter with relative entry in the correct format

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Solarwinds Platform
CVE-2024-28073

SolarWinds Serv-U Directory Traversal Remote Code Execution Vulnerability

SolarWinds Serv-U was found to be susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability requires a highly privileged account to be exploited.

CVSS 3.1 · 8.4 High EPSS 1.1% KEV · Not listed
Vendors
Solarwinds
Products
Serv-u
CVE-2022-36963

SolarWinds Platform Deserialization of Untrusted Data Vulnerability

The SolarWinds Platform was susceptible to the Command Injection Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform admin account to execute arbitrary commands.

CVSS 3.1 · 7.2 High EPSS 8.1% KEV · Not listed
Vendors
Solarwinds
Products
Orion Platform
CVE-2022-47505

SolarWinds Platform Local Privilege Escalation Vulnerability

The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a valid system user account to escalate local privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Orion Platform
CVE-2022-47509

SolarWinds Platform Incorrect Input Neutralization Vulnerability

The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Orion Platform