Network Performance Monitor vulnerabilities | LiveThreat CVE Feed

Product

Network Performance Monitor

by Solarwinds · last CVE Oct 21, 2021

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities8 In the news0 Timeline

Severity mix

Critical 1High 2Medium 5Low 0

Severity

All severities8 Critical1 High2 Medium5 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Network Performance Monitor to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2021-31474	9.8	94%	May 21	This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 2020.2.1 Affected: 2020.2.1 before 2020.2.5
CVE-2020-27869	8.8	5%	Feb 12	This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor 2020 HF1, NPM: 2020.2 Affected: 2020; 2020.2
CVE-2018-13442	8.8	2%	Jul 16	SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter Affected: through 12.3
CVE-2021-35225	6.4	1%	Oct 21	Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers Affected: through 2020.2.6; 2020.2.6
CVE-2019-12864	5.5	0%	May 4	SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by… Affected: 12.4
CVE-2017-9538	4.9	2%	Oct 3	The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cause a denial of service (permanent… Affected: through 12.0.15300.90
CVE-2019-12863	4.8	1%	Feb 25	SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen Affected: 12.4
CVE-2017-9537	4.8	3%	Oct 3	Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to introduce arbitrary… Affected: 12.0.15300.90