SolarWinds vulnerabilities
218 CVEs and advisories name SolarWinds as an affected vendor, 10 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-35248Unrestricted access to Orion.UserSettings SWIS entity for low-privilege users
- CVE-2021-35242A valid CSRF token is present in response to an invalid request
- CVE-2021-35245Broken Access Control Vulnerability for SolarWinds Serv-U
- CVE-2021-35237Clickjacking Vulnerability
- CVE-2021-35236Missing Secure Flag From SSL Cookie
- CVE-2021-35235ASP.NET Debug Feature Enabled
- CVE-2021-35233HTTP TRACK & TRACE Methods Enabled
- CVE-2021-35231Unquoted Path (SMB Login) Vulnerability
- CVE-2021-35230Unquoted Path Vulnerability (SMB Login) in Kiwi CatTools
- CVE-2021-35228Reflected cross site scripting affecting SolarWinds: DPA 2021.3.7388
- CVE-2021-35227Insecure Web Configuration for RabbitMQ Management Plugin in SolarWinds ARM
- CVE-2021-35225Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5
- CVE-2021-35214Session Management Vulnerability
- CVE-2021-35217Insecure Deserialization of untrusted data causing Remote code execution vulnerability.
- CVE-2021-35218Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2021-35216Deserialization of Untrusted Data in Resource Controls Remote Code Execution
- CVE-2021-35215ActionPluginBaseView Deserialization of Untrusted Data RCE
- CVE-2021-35238Stored XSS through URL POST parameter in CreateExternalWebsite Vulnerability
- CVE-2021-35212Blind SQL injection Vulnerability
- CVE-2021-35223Execute Command Function Allows Remote Code Execution (RCE)Vulnerability
- CVE-2021-35213Orion User setting Improper Access Control Privilege Escalation Vulnerability
- CVE-2021-35240Stored XSS via Help Server settings
- CVE-2021-35239Stored XSS in Maps text box hyperlink Vulnerability
- CVE-2021-35222Resource.aspx Reflected Cross-Site Scripting Vulnerability
- CVE-2021-35221ImportAlert Improper Access Control Tampering Vulnerability
- CVE-2021-35220EmailWebPage Command Injection RCE
- CVE-2021-35219ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability
- CVE-2021-32076Access Restriction bypass vulnerability via referrer spoof - Business Logic Bypass
- CVE-2021-35211Serv-U Remote Memory Escape Vulnerability
- CVE-2021-31475This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HF