Vulnerabilities

TI-2021-14118 CVE-2021-35225 · GHSA-25w6-fx24-w953

Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5

LOW 30

Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00844 Published 2021-10-21 Fixed in 2020.2.6 Hotfix 2

TI-2021-11603 CVE-2021-31474 · GHSA-v89w-qqfc-fph2

Deserialization of untrusted data in SolarWinds Network Performance Monitor

CRITICAL 86

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 2020.2.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.93939 Published 2021-05-21 No fix listed CWE-502

TI-2020-16937 CVE-2020-27869 · GHSA-f6fw-jv2q-2mh7

SQL injection in SolarWinds Network Performance Monitor

MEDIUM 46

This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor 2020 HF1, NPM: 2020.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05334 Published 2021-02-11 No fix listed CWE-89

TI-2019-09633 CVE-2019-12864 · GHSA-gqf4-w7p4-pm73

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to…

LOW 25

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Interna…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00466 Published 2020-05-04 No fix listed CWE-209

TI-2019-09632 CVE-2019-12863 · GHSA-q6rp-fxm7-mjq8

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML…

LOW 24

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.01076 Published 2020-02-25 No fix listed CWE-79

TI-2018-09665 CVE-2018-13442 · GHSA-fxmp-vj9m-pp6w

SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the…

MEDIUM 41

SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01634 Published 2019-07-16 No fix listed CWE-89

TI-2017-06944 CVE-2017-9538 · GHSA-hwf6-mrmq-vv3x

The 'Upload logo from external path' function of SolarWinds Network Performance Monitor…

LOW 27

The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cause a denial of service (permanent display of a "Cannot exit above the top direct…

CVSS 3.0MEDIUM 4.9 Network High privileges No interaction EPSS 0.02432 Published 2017-10-02 No fix listed CWE-20

TI-2017-06943 CVE-2017-9537 · GHSA-wrp6-hppf-h4vm

Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network…

LOW 27

Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to introduce arbitrary JavaScript into various vulnerable parameters.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.02822 Published 2017-10-02 No fix listed CWE-79

Vulnerabilities

Filters