Priority CRITICAL 100KEV
The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.9198 · Published 2020-12-29 · No fix listed CWE-288
Priority HIGH 81
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.81906 · Published 2022-10-20 · No fix listed CWE-502
Priority HIGH 79
A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.7432 · Published 2022-09-30 · Fixed in 2022.2.3 CWE-89
Priority HIGH 78
Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution.
CVSS 3.1HIGH 8.9· Adjacent network · Low privileges · No interaction · EPSS 0.76411 · Published 2021-09-01 · Fixed in 2020.2.6 CWE-502
Priority HIGH 76
Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5.
CVSS 3.1HIGH 8.9· Adjacent network · Low privileges · No interaction · EPSS 0.69941 · Published 2021-09-01 · Fixed in 2020.2.6 CWE-502
Priority HIGH 75
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.84803 · Published 2023-02-15 · No fix listed CWE-502
Priority HIGH 75
This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.9083 · Published 2021-02-10 · No fix listed CWE-22
Priority HIGH 74
SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.80298 · Published 2023-02-15 · No fix listed CWE-502
Priority HIGH 70
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.66597 · Published 2022-10-20 · No fix listed CWE-502
Priority HIGH 68
The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.36426 · Published 2021-02-03 · No fix listed CWE-502
Priority MEDIUM 62
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.41939 · Published 2023-02-15 · No fix listed CWE-502
Priority MEDIUM 62
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.41047 · Published 2023-02-15 · No fix listed CWE-502
Priority MEDIUM 57
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.1775 · Published 2022-11-29 · No fix listed CWE-502
Priority MEDIUM 49
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.14998 · Published 2022-10-20 · No fix listed CWE-502
Priority MEDIUM 49
This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion Platform 2020.2.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04122 · Published 2021-04-14 · No fix listed CWE-284
Priority MEDIUM 48
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.12944 · Published 2023-02-15 · No fix listed CWE-502
Priority MEDIUM 47
SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02776 · Published 2019-03-01 · No fix listed CWE-427
Priority MEDIUM 46
This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.02614 · Published 2021-08-31 · Fixed in 2020.2.6 HF1 CWE-79
Priority MEDIUM 45
The SolarWinds Platform was susceptible to the Command Injection Vulnerability.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.08153 · Published 2023-04-21 · No fix listed CWE-94
Priority MEDIUM 45
SolarWinds Platform was susceptible to Command Injection.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0937 · Published 2022-11-29 · No fix listed CWE-78
Priority MEDIUM 44
An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5.
CVSS 3.1HIGH 8.9· Adjacent network · Low privileges · No interaction · EPSS 0.03369 · Published 2021-08-31 · Fixed in 2020.2.5 CWE-284
Priority MEDIUM 43
Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02888 · Published 2021-12-20 · Fixed in 2020.2.6 HF 3 CWE-89
Priority MEDIUM 43
Stored XSS (Cross-Site Scripting) exists in the SolarWinds Orion Platform before before 2020.2.1 on multiple forms and pages.
CVSS 3.1CRITICAL 9.0· Network · Low privileges · User interaction · EPSS 0.02208 · Published 2020-09-17 · No fix listed CWE-79
Priority MEDIUM 42
The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.05429 · Published 2023-09-13 · Fixed in 2023.3.1 CWE-697
Priority MEDIUM 42
The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.05429 · Published 2023-09-13 · Fixed in 2023.3.1 CWE-697
Load more
THREATIST.IORead the docs