Vulnerabilities for Network performance monitor (...) - CXSECURITY.COM

Vulnerabilities for 'Network performance monitor'

2021-10-21

CVE-2021-35225

CWE-269

Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination.

2021-05-21

CVE-2021-31474

CWE-502

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 2020.2.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SolarWinds.Serialization library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-12213.

2021-02-12

CVE-2020-27869

CWE-89

This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor 2020 HF1, NPM: 2020.2. Authentication is required to exploit this vulnerability. The specific flaw exists within the WriteToFile method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges and reset the password for the Admin user. Was ZDI-CAN-11804.

2020-05-04

CVE-2019-12864

CWE-200

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query parameter.

2020-02-25

CVE-2019-12863

CWE-74

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen.

2019-07-16

CVE-2018-13442

CWE-89

SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter.

2017-10-02

CVE-2017-9538

CWE-20

The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cause a denial of service (permanent display of a "Cannot exit above the top directory" error message throughout the entire web application) via a ".." in the path field. In other words, the denial of service is caused by an incorrect implementation of a directory-traversal protection mechanism.

CVE-2017-9537

CWE-79

Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to introduce arbitrary JavaScript into various vulnerable parameters.

>>> Vendor: Solarwinds 46 Products

Orion network performance monitor

Virtualization manager

Ip address manager web interface

Network configuration manager

Log and event manager

Server and application monitor

Orion ip address manager

Orion netflow traffic analyzer

Orion network configuration manager

Orion server and application manager

Orion user device tracker

Orion voip & network quality manager

Orion web performance monitor

Firewall security manager

Storage manager

N-able n-central

Storage resource monitor

Log & event manager

Network performance monitor

Sftp/scp server

Serv-u ftp server

Damewire mini remote control

Database performance analyzer

Dameware mini remote control firmware

Dameware remote support

Serv-u managed file transfer

Managed service provider patch management engine

Advanced monitoring agent

Orion virtual infrastructure monitor

Serv-u file server

Dameware mini remote control

Kiwi syslog server

Access rights manager

Copyright 2024, cxsecurity.com