OP
IT Management
Orion Platform
On CISA KEVExploited in the wild
50
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 28Medium 16Low 0
Watch
Add Orion Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-27870 | 6.5 | Feb 10 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1 Affected: 2020.2.1 |
| CVE-2022-47509 | 6.1 | Apr 21 | The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability Affected: before 2023.2 |
| CVE-2022-36965 | 6.1 | Sep 30 | Stored and DOM XSS in QoE Applications: Orion Platform Affected: 2020.2.6 and previous versions before 2022.3.0 |
| CVE-2019-17127 | 6.1 | Jan 17 | A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms Affected: 2019.2 |
| CVE-2019-17125 | 6.1 | Jan 17 | A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms Affected: 2019.2 |
| CVE-2019-12864 | 5.5 | May 4 | SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by… Affected: 2018.4 |
| CVE-2022-36966 | 5.4 | Oct 20 | Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6 Affected: before 2020.2.6; 2020.2.6; 2020.2.6; 2020.2.6; 2020.2.6; 2020.2.6; +3 more |
| CVE-2021-35239 | 5.4 | Aug 31 | A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink Affected: through 2020.2.5; 2020.2.6 |
| CVE-2021-28674 | 5.4 | Jul 30 | The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker's perimeter) via an account with… Affected: through 2020.2.5 |
| CVE-2021-35219 | 4.9 | Aug 31 | ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page Affected: before 2020.2.6 |
| CVE-2021-35238 | 4.8 | Sep 1 | User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website Affected: through 2020.2.5; 2020.2.6 |
| CVE-2021-35240 | 4.8 | Aug 31 | A security researcher stored XSS via a Help Server setting Affected: through 2020.2.5 |
| CVE-2021-3109 | 4.8 | Mar 26 | The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account Affected: before 2020.2.5 |
| CVE-2020-35856 | 4.8 | Mar 26 | SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page Affected: before 2020.2.5 |
| CVE-2019-12863 | 4.8 | Feb 25 | SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen Affected: 2018.4 |
| CVE-2021-35248 | 4.3 | Dec 20 | It has been reported that any Orion user, e.g Affected: before 2020.2.6; 2020.2.6; 2020.2.6; 2020.2.6 |
Showing 16