# SolarWinds Orion Platform.

Every CVE that names SolarWinds Orion Platform among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [SolarWinds Platform Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2022-36964.md)
  `CVE-2022-36964` · CVE record: SolarWinds SolarWinds Platform and 1 more · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.18 · Not analysed yet · Published 29 Nov 2022 · Tags: Insecure deserialization
- [SolarWinds Platform Command Injection](https://agentprime.io/advisories/CVE-2022-36962.md)
  `CVE-2022-36962` · CVE record: SolarWinds SolarWinds Platform and 1 more · CVSS 7.2 High · Not analysed yet · Published 29 Nov 2022 · Tags: Command injection
- [SolarWinds Platform Improper Input Validation](https://agentprime.io/advisories/CVE-2022-36960.md)
  `CVE-2022-36960` · CVE record: SolarWinds SolarWinds Platform and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Nov 2022 · Tags: Authentication bypass, CWE-20
- [SolarWinds Platform Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2022-38108.md)
  `CVE-2022-38108` · CVE record: SolarWinds SolarWinds Platform and 1 more · CVSS 7.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.67 · Not analysed yet · Published 20 Oct 2022 · Tags: Insecure deserialization
- [SolarWinds Platform Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2022-36958.md)
  `CVE-2022-36958` · CVE record: SolarWinds SolarWinds Platform and 1 more · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.82 · Not analysed yet · Published 20 Oct 2022 · Tags: Insecure deserialization
- [SolarWinds Platform Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2022-36957.md)
  `CVE-2022-36957` · CVE record: SolarWinds SolarWinds Platform and 1 more · CVSS 7.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 20 Oct 2022 · Tags: Insecure deserialization
- [Stored and DOM XSS in QoE Applications: Orion Platform](https://agentprime.io/advisories/CVE-2022-36965.md)
  `CVE-2022-36965` · CVE record: SolarWinds Orion Platform · CVSS 6.1 Medium · Not analysed yet · Published 30 Sept 2022 · Tags: Cross-site scripting (XSS)
- [Orion Platform SQL Injection Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2022-36961.md)
  `CVE-2022-36961` · CVE record: SolarWinds Orion Platform · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.74 · Not analysed yet · Published 30 Sept 2022 · Tags: SQL injection
- [Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6](https://agentprime.io/advisories/CVE-2021-35244.md)
  `CVE-2021-35244` · CVE record: SolarWinds Orion Platform · CVSS 6.8 Medium · Not analysed yet · Published 20 Dec 2021
- [Insecure Deserialization of untrusted data causing Remote code execution vulnerability.](https://agentprime.io/advisories/CVE-2021-35217.md)
  `CVE-2021-35217` · CVE record: SolarWinds Orion Platform · CVSS 8.9 High · Critical (CVSS 7+ and EPSS) · EPSS 0.73 · Not analysed yet · Published 8 Sept 2021
- [ActionPluginBaseView Deserialization of Untrusted Data RCE](https://agentprime.io/advisories/CVE-2021-35215.md)
  `CVE-2021-35215` · CVE record: SolarWinds Orion Platform · CVSS 8.9 High · Critical (CVSS 7+ and EPSS) · EPSS 0.70 · Not analysed yet · Published 1 Sept 2021 · Tags: Insecure deserialization
- [Stored XSS through URL POST parameter in CreateExternalWebsite Vulnerability](https://agentprime.io/advisories/CVE-2021-35238.md)
  `CVE-2021-35238` · CVE record: SolarWinds Orion Platform · CVSS 4.8 Medium · Not analysed yet · Published 1 Sept 2021 · Tags: Cross-site scripting (XSS)
- [Blind SQL injection Vulnerability](https://agentprime.io/advisories/CVE-2021-35212.md)
  `CVE-2021-35212` · CVE record: SolarWinds Orion Platform · CVSS 8.9 High · Not analysed yet · Published 31 Aug 2021
- [Orion User setting Improper Access Control Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2021-35213.md)
  `CVE-2021-35213` · CVE record: SolarWinds Orion Platform · CVSS 8.9 High · Not analysed yet · Published 31 Aug 2021 · Tags: Broken access control
- [Stored XSS via Help Server settings](https://agentprime.io/advisories/CVE-2021-35240.md)
  `CVE-2021-35240` · CVE record: SolarWinds Orion Platform · CVSS 6.5 Medium · Not analysed yet · Published 31 Aug 2021 · Tags: Cross-site scripting (XSS)
- [Stored XSS in Maps text box hyperlink Vulnerability](https://agentprime.io/advisories/CVE-2021-35239.md)
  `CVE-2021-35239` · CVE record: SolarWinds Orion Platform · CVSS 7.5 High · Not analysed yet · Published 31 Aug 2021 · Tags: Cross-site scripting (XSS)
- [Resource.aspx Reflected Cross-Site Scripting Vulnerability](https://agentprime.io/advisories/CVE-2021-35222.md)
  `CVE-2021-35222` · CVE record: SolarWinds Orion Platform · CVSS 8.0 High · Not analysed yet · Published 31 Aug 2021 · Tags: Cross-site scripting (XSS)
- [ImportAlert Improper Access Control Tampering Vulnerability](https://agentprime.io/advisories/CVE-2021-35221.md)
  `CVE-2021-35221` · CVE record: SolarWinds Orion Platform · CVSS 6.3 Medium · Not analysed yet · Published 31 Aug 2021 · Tags: Broken access control
- [EmailWebPage Command Injection RCE](https://agentprime.io/advisories/CVE-2021-35220.md)
  `CVE-2021-35220` · CVE record: SolarWinds Orion Platform · CVSS 8.1 High · Not analysed yet · Published 31 Aug 2021
- [ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2021-35219.md)
  `CVE-2021-35219` · CVE record: SolarWinds Orion Platform · CVSS 6.0 Medium · Not analysed yet · Published 31 Aug 2021
- [Improper access control in SolarWinds Orion Platform](https://agentprime.io/advisories/CVE-2021-27258.md)
  `CVE-2021-27258` · CVE record: SolarWinds Orion Platform · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2021 · Tags: Broken access control
- [Path traversal in SolarWinds Orion Platform](https://agentprime.io/advisories/CVE-2020-27871.md)
  `CVE-2020-27871` · CVE record: SolarWinds Orion Platform · CVSS 7.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.91 · Not analysed yet · Published 10 Feb 2021 · Tags: Path traversal
- [Path traversal in SolarWinds Orion Platform](https://agentprime.io/advisories/CVE-2020-27870.md)
  `CVE-2020-27870` · CVE record: SolarWinds Orion Platform · CVSS 7.5 High · Not analysed yet · Published 10 Feb 2021 · Tags: Path traversal
- [SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands](https://agentprime.io/advisories/CVE-2020-10148.md)
  `CVE-2020-10148` · CVE record: SolarWinds Orion Platform · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.92 · Not analysed yet · Published 29 Dec 2020 · Tags: Authentication bypass

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=solarwinds-orion-platform>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/solarwinds-orion-platform/>. Everything for agents: <https://agentprime.io/llms.txt>.