Solarwinds

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-15910 1Solarwinds 1N Central Jun 17, 2026 Oct 19, 2020 N/A· v4 4.7 MEDIUM· v3 4.3 MEDIUM· v2 SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or b...Show more SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be forwarded to the attacker.Show less
CVE-2020-15909 1Solarwinds 1N Central Jun 17, 2026 Oct 19, 2020 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim...Show more SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take advantage of this, cookie could be stolen and the JSESSIONID can be captured. On its own this is not a surprising result; low security tools allow the cookie to roam from machine to machine. The JSESSION cookie can then be used on the attackers’ workstation by browsing to the victim’s NCentral server URL and replacing the JSESSIONID attribute value by the captured value. Expected behavior would be to check this against a second source and enforce at least a reauthentication or multi factor request as N-Central is a highly privileged service.Show less
CVE-2020-13169 1Solarwinds 1Orion Platform Jun 17, 2026 Sep 17, 2020 N/A· v4 9.0 CRITICAL· v3 3.5 LOW· v2 Stored XSS (Cross-Site Scripting) exists in the SolarWinds Orion Platform before before 2020.2.1 on multiple forms and pages. This vulnerability may lead to the Information Disclosure and Escalation of Privileges (takeov...Show more Stored XSS (Cross-Site Scripting) exists in the SolarWinds Orion Platform before before 2020.2.1 on multiple forms and pages. This vulnerability may lead to the Information Disclosure and Escalation of Privileges (takeover of administrator account).Show less
CVE-2020-15576 1Solarwinds 1Serv U Jun 17, 2026 Jul 7, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response.
CVE-2020-15575 1Solarwinds 1Serv U Jun 17, 2026 Jul 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SolarWinds Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan, aka Case Number 00484194.
CVE-2020-15574 1Solarwinds 1Serv U Jun 17, 2026 Jul 7, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 SolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893.
CVE-2020-15573 1Solarwinds 1Serv U Jun 17, 2026 Jul 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421.
CVE-2020-15543 1Solarwinds 1Serv U Ftp Server Jun 17, 2026 Jul 5, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SolarWinds Serv-U FTP server before 15.2.1 does not validate an argument path.
CVE-2020-15542 1Solarwinds 1Serv U Ftp Server Jun 17, 2026 Jul 5, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command.
CVE-2020-15541 1Solarwinds 1Serv U Ftp Server Jun 17, 2026 Jul 5, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SolarWinds Serv-U FTP server before 15.2.1 allows remote command execution.
CVE-2020-14007 1Solarwinds 2Orion Network Performance Monitor Orion Web Performance Monitor Jun 17, 2026 Jun 24, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a name of an alert definition.
CVE-2020-14006 1Solarwinds 2Orion Network Performance Monitor Orion Web Performance Monitor Jun 17, 2026 Jun 24, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a Responsible Team.
CVE-2020-14005 1Solarwinds 2Orion Network Performance Monitor Orion Web Performance Monitor Jun 17, 2026 Jun 24, 2020 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code via a defined event.
CVE-2020-13912 1Solarwinds 1Advanced Monitoring Agent Jun 17, 2026 Jun 7, 2020 N/A· v4 7.3 HIGH· v3 6.0 MEDIUM· v2 SolarWinds Advanced Monitoring Agent before 10.8.9 allows local users to gain privileges via a Trojan horse .exe file, because everyone can write to a certain .exe file.
CVE-2020-12608 1Solarwinds 1Managed Service Provider Patch Management Engine Jun 17, 2026 May 7, 2020 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecure file permissions for %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.Ca...Show more An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecure file permissions for %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.CacheService\config\. This can lead to code execution by changing the CacheService.xml SISServerURL parameter.Show less
CVE-2019-12864 1Solarwinds 3Netpath Network Performance MonitorOrion Platform Jun 17, 2026 May 4, 2020 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Interna...Show more SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query parameter.Show less
CVE-2019-20002 1Solarwinds 1Webhelpdesk Jun 17, 2026 Apr 27, 2020 N/A· v4 7.8 HIGH· v3 6.0 MEDIUM· v2 Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value (provided by a low-privileged user in the Subject field of a help request form) that is mishandled in a TicketActions/view?tab=g...Show more Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value (provided by a low-privileged user in the Subject field of a help request form) that is mishandled in a TicketActions/view?tab=group TSV export by an admin user.Show less
CVE-2020-5734 1Solarwinds 1Dameware Jun 17, 2026 Apr 7, 2020 N/A· v4 7.5 HIGH· v3 4.3 MEDIUM· v2 Classic buffer overflow in SolarWinds Dameware allows a remote, unauthenticated attacker to cause a denial of service by sending a large 'SigPubkeyLen' during ECDH key exchange.
CVE-2019-12769 1Solarwinds 1Serv U Managed File Transfer Jun 17, 2026 Mar 18, 2020 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 SolarWinds Serv-U Managed File Transfer (MFT) Web client before 15.1.6 Hotfix 2 is vulnerable to Cross-Site Request Forgery in the file upload functionality via ?Command=Upload with the Dir and File parameters.
CVE-2019-12863 1Solarwinds 3Netpath Network Performance MonitorOrion Platform Jun 17, 2026 Feb 25, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen.

Previous 1...111213...16 Next