Advisories · Technology

SolarWinds Orion Platform.

Every CVE that names SolarWinds Orion Platform among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2022-36964 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

SolarWinds Platform Deserialization of Untrusted Data
- SolarWinds Platform
- SolarWinds Orion Platform
- Insecure deserialization
Not analysed yet 29 Nov 2022
CVE-2022-36962 CVE record

CVSS 7.2 High

SolarWinds Platform Command Injection
- SolarWinds Platform
- SolarWinds Orion Platform
- Command injection
Not analysed yet 29 Nov 2022
CVE-2022-36960 CVE record

CVSS 8.8 High

SolarWinds Platform Improper Input Validation
- SolarWinds Platform
- SolarWinds Orion Platform
- Authentication bypass
- CWE-20
Not analysed yet 29 Nov 2022
CVE-2022-38108 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

SolarWinds Platform Deserialization of Untrusted Data
- SolarWinds Platform
- SolarWinds Orion Platform
- Insecure deserialization
Not analysed yet 20 Oct 2022
CVE-2022-36958 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

SolarWinds Platform Deserialization of Untrusted Data
- SolarWinds Platform
- SolarWinds Orion Platform
- Insecure deserialization
Not analysed yet 20 Oct 2022
CVE-2022-36957 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

SolarWinds Platform Deserialization of Untrusted Data
- SolarWinds Platform
- SolarWinds Orion Platform
- Insecure deserialization
Not analysed yet 20 Oct 2022
CVE-2022-36965 CVE record

CVSS 6.1 Medium

Stored and DOM XSS in QoE Applications: Orion Platform
- SolarWinds Orion Platform
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2022
CVE-2022-36961 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Orion Platform SQL Injection Privilege Escalation Vulnerability
- SolarWinds Orion Platform
- SQL injection
Not analysed yet 30 Sept 2022
CVE-2021-35244 CVE record

CVSS 6.8 Medium

Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6
- SolarWinds Orion Platform
Not analysed yet 20 Dec 2021
CVE-2021-35217 CVE record

CVSS 8.9 HighCritical · CVSS 7+ and EPSS

Insecure Deserialization of untrusted data causing Remote code execution vulnerability.
- SolarWinds Orion Platform
Not analysed yet 8 Sept 2021
CVE-2021-35215 CVE record

CVSS 8.9 HighCritical · CVSS 7+ and EPSS

ActionPluginBaseView Deserialization of Untrusted Data RCE
- SolarWinds Orion Platform
- Insecure deserialization
Not analysed yet 1 Sept 2021
CVE-2021-35238 CVE record

CVSS 4.8 Medium

Stored XSS through URL POST parameter in CreateExternalWebsite Vulnerability
- SolarWinds Orion Platform
- Cross-site scripting (XSS)
Not analysed yet 1 Sept 2021
CVE-2021-35212 CVE record

CVSS 8.9 High

Blind SQL injection Vulnerability
- SolarWinds Orion Platform
Not analysed yet 31 Aug 2021
CVE-2021-35213 CVE record

CVSS 8.9 High

Orion User setting Improper Access Control Privilege Escalation Vulnerability
- SolarWinds Orion Platform
- Broken access control
Not analysed yet 31 Aug 2021
CVE-2021-35240 CVE record

CVSS 6.5 Medium

Stored XSS via Help Server settings
- SolarWinds Orion Platform
- Cross-site scripting (XSS)
Not analysed yet 31 Aug 2021
CVE-2021-35239 CVE record

CVSS 7.5 High

Stored XSS in Maps text box hyperlink Vulnerability
- SolarWinds Orion Platform
- Cross-site scripting (XSS)
Not analysed yet 31 Aug 2021
CVE-2021-35222 CVE record

CVSS 8.0 High

Resource.aspx Reflected Cross-Site Scripting Vulnerability
- SolarWinds Orion Platform
- Cross-site scripting (XSS)
Not analysed yet 31 Aug 2021
CVE-2021-35221 CVE record

CVSS 6.3 Medium

ImportAlert Improper Access Control Tampering Vulnerability
- SolarWinds Orion Platform
- Broken access control
Not analysed yet 31 Aug 2021
CVE-2021-35220 CVE record

CVSS 8.1 High

EmailWebPage Command Injection RCE
- SolarWinds Orion Platform
Not analysed yet 31 Aug 2021
CVE-2021-35219 CVE record

CVSS 6.0 Medium

ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability
- SolarWinds Orion Platform
Not analysed yet 31 Aug 2021
CVE-2021-27258 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Improper access control in SolarWinds Orion Platform
- SolarWinds Orion Platform
- Broken access control
Not analysed yet 14 Apr 2021
CVE-2020-27871 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

Path traversal in SolarWinds Orion Platform
- SolarWinds Orion Platform
- Path traversal
Not analysed yet 10 Feb 2021
CVE-2020-27870 CVE record

CVSS 7.5 High

Path traversal in SolarWinds Orion Platform
- SolarWinds Orion Platform
- Path traversal
Not analysed yet 10 Feb 2021
CVE-2020-10148 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands
- SolarWinds Orion Platform
- Authentication bypass
Not analysed yet 29 Dec 2020