CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 01/09/2021 |
| CVE-2021-35216 | ALTO8.8 | Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authenticated Attacker with network access via HTTP can compromise this vulnerability can result in Remote Code Execution. | 01/09/2021 |
| CVE-2021-35215 | ALTO8.8 | Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability. | 01/09/2021 |
| CVE-2021-35238 | MÉDIO4.8 | User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website. | 01/09/2021 |
| CVE-2021-35212 | ALTO8.8 | An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injection which could lead to full read/write over the Orion database content including the Orion certificate for any authenticated user. | 31/08/2021 |
| CVE-2021-35240 | MÉDIO4.8 | A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'. | 31/08/2021 |
| CVE-2021-35239 | MÉDIO5.4 | A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink. | 31/08/2021 |
| CVE-2021-35223 | ALTO8.8 | The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution. | 31/08/2021 |
| CVE-2021-35213 | ALTO8.8 | An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to elevate privileges to the Administrator using this vulnerability. Authentication is required to exploit the vulnerability. | 31/08/2021 |
| CVE-2021-35222 | CRÍTICO9.6 | This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page. | 31/08/2021 |
| CVE-2021-35221 | ALTO8.1 | Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page. | 31/08/2021 |
| CVE-2021-35220 | ALTO7.2 | Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page. | 31/08/2021 |
| CVE-2021-35219 | MÉDIO4.9 | ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page. | 31/08/2021 |
| CVE-2021-32076 | MÉDIO5.3 | Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing | 26/08/2021 |
| CVE-2021-28674 | MÉDIO5.4 | The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) via an account with write permissions. This occurs because node IDs are predictable (with incrementing numbers) and the access control on Services/NodeManagement. | 30/07/2021 |
| CVE-2021-35211KEV | CRÍTICO10.0 | Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windo | 14/07/2021 |
| CVE-2021-31217 | CRÍTICO9.1 | In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM. | 13/07/2021 |
| CVE-2021-31475 | ALTO8.8 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HF 2. Authentication is required to exploit this vulnerability. The specific flaw exists within the JobRouterService WCF service. The issue is due to the WCF service configuration, w | 21/05/2021 |