| CVE-2024-28072 | MEDIO4.9 | A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly.
| 03/05/2024 |
| CVE-2024-29003 | MEDIO4.8 | The SolarWinds Platform was susceptible to a XSS vulnerability that affects the maps section of the user interface. This vulnerability requires authentication and requires user interaction. | 18/04/2024 |
| CVE-2024-29001 | ALTO7.4 | A SolarWinds Platform SWQL Injection Vulnerability was identified in the user interface. This vulnerability requires authentication and user interaction to be exploited. | 18/04/2024 |
| CVE-2024-28076 | BAJO3.8 | The SolarWinds Platform was susceptible to a Arbitrary Open Redirection Vulnerability. A potential attacker can redirect to different domain when using URL parameter with relative entry in the correct format | 18/04/2024 |
| CVE-2024-28073 | ALTO7.2 | SolarWinds Serv-U was found to be susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability requires a highly privileged account to be exploited.
| 17/04/2024 |
| CVE-2024-0692 | ALTO8.8 | The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ service, resulting in remote code execution. | 01/03/2024 |
| CVE-2024-23479 | CRÍTICO9.6 | SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve a Remote Code Execution.
| 15/02/2024 |
| CVE-2024-23478 | ALTO8.0 | SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service, resulting in remote code execution.
| 15/02/2024 |
| CVE-2024-23477 | CRÍTICO9.6 | The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve a Remote Code Execution.
| 15/02/2024 |
| CVE-2024-23476 | CRÍTICO9.6 | The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve the Remote Code Execution.
| 15/02/2024 |
| CVE-2023-40057 | CRÍTICO9.0 | The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service resulting in remote code execution.
| 15/02/2024 |
| CVE-2023-50395 | ALTO8.0 |
SQL Injection Remote Code Execution Vulnerability was found using an update statement in the SolarWinds Platform. This vulnerability requires user authentication to be exploited | 06/02/2024 |
| CVE-2023-35188 | ALTO8.0 |
SQL Injection Remote Code Execution Vulnerability was found using a create statement in the SolarWinds Platform. This vulnerability requires user authentication to be exploited. | 06/02/2024 |
| CVE-2023-40058 | MEDIO6.5 | Sensitive data was added to our public-facing knowledgebase that, if exploited, could be used to access components of Access Rights Manager (ARM) if the threat actor is in the same environment.
| 21/12/2023 |
| CVE-2023-40053 | MEDIO5.0 | A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function feature of Serv-U, which could be used maliciously. | 06/12/2023 |
| CVE-2023-40056 | ALTO8.8 |
SQL Injection Remote Code Vulnerability was found in the SolarWinds
Platform. This vulnerability can be exploited with a low privileged account.
| 28/11/2023 |
| CVE-2023-40055 | ALTO8.8 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges. We found this issue was not resolved in CVE-2023-33227 | 09/11/2023 |
| CVE-2023-40054 | ALTO8.8 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges. We found this issue was not resolved in CVE-2023-33226 | 09/11/2023 |
| CVE-2023-40062 | ALTO8.8 | SolarWinds Platform Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability. If executed, this vulnerability would allow a low-privileged user to execute commands with SYSTEM privileges. | 01/11/2023 |
| CVE-2023-40061 | ALTO8.8 | Insecure
job execution mechanism vulnerability. This
vulnerability can lead to other attacks as a result.
| 01/11/2023 |