SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion Platform 2020.2

The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues

SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service

This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page

Stored XSS (Cross-Site Scripting) exists in the SolarWinds Orion Platform before before 2020.2.1 on multiple forms and pages

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data

SolarWinds Platform was susceptible to Improper Input Validation

SolarWinds Platform Deserialization of Untrusted Data

Orion Platform SQL Injection Privilege Escalation Vulnerability

Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation

Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution

Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5

An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team

An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5

Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page

The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability

SolarWinds Platform was susceptible to the Directory Traversal Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual Infrastructure Monitor 2020.2

SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores database credentials to access this backend…

The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability

The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability

The SolarWinds Platform was susceptible to the Command Injection Vulnerability

SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data

SolarWinds Platform was susceptible to Command Injection

SolarWinds Platform Deserialization of Untrusted Data

SolarWinds Platform Deserialization of Untrusted Data

The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file

Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page

This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1

This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1

The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability

Stored and DOM XSS in QoE Applications: Orion Platform

A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms

A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by…

Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6

A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink

The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) via an account with…

ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page

User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website

A security researcher stored XSS via a Help Server setting

The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account

SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen

It has been reported that any Orion user, e.g