cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,exploited_date,poc,trended,trended_no_1,trended_no_1_date,published,trended_score
CVE-2021-31474,https://securityvulnerability.io/vulnerability/CVE-2021-31474,Remote Code Execution Vulnerability in SolarWinds Network Performance Monitor,"This vulnerability affects SolarWinds Network Performance Monitor 2020.2.1, enabling remote attackers to execute arbitrary code without authentication. The flaw lies within the SolarWinds.Serialization library due to inadequate validation of user-supplied data, leading to the deserialization of untrusted data. An attacker can exploit this vulnerability to run code in the context of the SYSTEM account, which may compromise the integrity and security of the affected system.",Solarwinds,Network Performance Monitor,9.8,CRITICAL,0.3283100128173828,false,,false,false,false,,,false,false,,2021-05-21T14:40:15.000Z,0
CVE-2020-27869,https://securityvulnerability.io/vulnerability/CVE-2020-27869,Privilege Escalation in SolarWinds Network Performance Monitor by Remote Attackers,"This vulnerability in SolarWinds Network Performance Monitor allows authenticated remote attackers to escalate user privileges. It stems from inadequate validation of user-supplied input within the WriteToFile method, which is exploited to improperly construct SQL queries. By leveraging this flaw, an attacker may reset the password for the Admin account, gaining unauthorized control over the system. For more details, refer to the advisory at Zero Day Initiative.",Solarwinds,Network Performance Monitor,8.8,HIGH,0.007019999902695417,false,,false,false,false,,,false,false,,2021-02-12T00:15:00.000Z,0
CVE-2020-14005,https://securityvulnerability.io/vulnerability/CVE-2020-14005,,"Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code via a defined event.",Solarwinds,"Orion Network Performance Monitor,Orion Web Performance Monitor",8.8,HIGH,0.13370999693870544,false,,false,false,false,,,false,false,,2020-06-24T13:28:21.000Z,0
CVE-2020-14006,https://securityvulnerability.io/vulnerability/CVE-2020-14006,,"Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a Responsible Team.",Solarwinds,"Orion Network Performance Monitor,Orion Web Performance Monitor",5.4,MEDIUM,0.0007399999885819852,false,,false,false,false,,,false,false,,2020-06-24T13:27:26.000Z,0
CVE-2020-14007,https://securityvulnerability.io/vulnerability/CVE-2020-14007,,"Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a name of an alert definition.",Solarwinds,"Orion Network Performance Monitor,Orion Web Performance Monitor",5.4,MEDIUM,0.0007399999885819852,false,,false,false,false,,,false,false,,2020-06-24T13:24:58.000Z,0
CVE-2019-12864,https://securityvulnerability.io/vulnerability/CVE-2019-12864,,"SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query parameter.",Solarwinds,"Netpath,Orion Platform,Network Performance Monitor",5.5,MEDIUM,0.0004799999878741801,false,,false,false,false,,,false,false,,2020-05-04T13:30:46.000Z,0
CVE-2019-12863,https://securityvulnerability.io/vulnerability/CVE-2019-12863,,"SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen.",Solarwinds,"Netpath,Orion Platform,Network Performance Monitor",4.8,MEDIUM,0.0007399999885819852,false,,false,false,false,,,false,false,,2020-02-25T16:52:09.000Z,0
CVE-2019-12954,https://securityvulnerability.io/vulnerability/CVE-2019-12954,,"SolarWinds Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) allows XSS by authenticated users via a crafted onerror attribute of a VIDEO element in an action for an ALERT.",Solarwinds,"Network Performance Monitor Orion Platform 2018 Netpath,Network Performance Monitor Orion Platform 2018 Npm",5.4,MEDIUM,0.0007399999885819852,false,,false,false,false,,,false,false,,2020-02-17T16:42:27.000Z,0
CVE-2018-13442,https://securityvulnerability.io/vulnerability/CVE-2018-13442,,SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter.,Solarwinds,Network Performance Monitor,8.8,HIGH,0.00107999995816499,false,,false,false,false,,,false,false,,2019-07-16T17:56:43.000Z,0
CVE-2019-8917,https://securityvulnerability.io/vulnerability/CVE-2019-8917,,"SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote, unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method may be abused by an attacker to execute commands as the SYSTEM user.",Solarwinds,Orion Network Performance Monitor,9.8,CRITICAL,0.13755999505519867,false,,false,false,false,,,false,false,,2019-02-18T19:00:00.000Z,0
CVE-2017-9537,https://securityvulnerability.io/vulnerability/CVE-2017-9537,,Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to introduce arbitrary JavaScript into various vulnerable parameters.,Solarwinds,Network Performance Monitor,4.8,MEDIUM,0.0005499999970197678,false,,false,false,false,,,false,false,,2017-10-03T01:29:00.000Z,0
CVE-2017-9538,https://securityvulnerability.io/vulnerability/CVE-2017-9538,,"The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cause a denial of service (permanent display of a ""Cannot exit above the top directory"" error message throughout the entire web application) via a "".."" in the path field. In other words, the denial of service is caused by an incorrect implementation of a directory-traversal protection mechanism.",Solarwinds,Network Performance Monitor,4.9,MEDIUM,0.001500000013038516,false,,false,false,false,,,false,false,,2017-10-02T14:00:00.000Z,0
CVE-2014-9566,https://securityvulnerability.io/vulnerability/CVE-2014-9566,,"Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor (NPM) before 11.5, NetFlow Traffic Analyzer (NTA) before 4.1, Network Configuration Manager (NCM) before 7.3.2, IP Address Manager (IPAM) before 4.3, User Device Tracker (UDT) before 3.2, VoIP & Network Quality Manager (VNQM) before 4.2, Server & Application Manager (SAM) before 6.2, Web Performance Monitor (WPM) before 2.2, and possibly other Solarwinds products, allow remote authenticated users to execute arbitrary SQL commands via the (1) dir or (2) sort parameter to the (a) GetAccounts or (b) GetAccountGroups endpoint.",Solarwinds,"Orion Netflow Traffic Analyzer,Orion Web Performance Monitor,Orion Network Configuration Manager,Orion User Device Tracker,Orion Ip Address Manager,Orion Voip \& Network Quality Manager,Orion Server And Application Manager,Orion Network Performance Monitor",,,0.9467399716377258,false,,false,false,false,,,false,false,,2015-03-10T14:00:00.000Z,0
CVE-2012-4939,https://securityvulnerability.io/vulnerability/CVE-2012-4939,,"Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the ""Search for an IP address"" field.",Solarwinds,"Orion Network Performance Monitor,Ip Address Manager Web Interface",,,0.23047000169754028,false,,false,false,false,,,false,false,,2012-10-31T19:55:00.000Z,0
CVE-2012-2602,https://securityvulnerability.io/vulnerability/CVE-2012-2602,,Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts via CreateUserStepContainer actions to Admin/Accounts/Add/OrionAccount.aspx or (2) modify account privileges via a ynAdminRights action to Admin/Accounts/EditAccount.aspx.,Solarwinds,Orion Network Performance Monitor,,,0.014639999717473984,false,,false,false,false,,,false,false,,2012-08-12T16:55:00.000Z,0
CVE-2012-2577,https://securityvulnerability.io/vulnerability/CVE-2012-2577,,"Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName field of an snmpd.conf file.",Solarwinds,Orion Network Performance Monitor,,,0.00791999977082014,false,,false,false,false,,,false,false,,2012-08-12T16:00:00.000Z,0
CVE-2010-4828,https://securityvulnerability.io/vulnerability/CVE-2010-4828,,Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) 10.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Title parameter to MapView.aspx; NetObject parameter to (2) NodeDetails.aspx and (3) InterfaceDetails.aspx; and the (4) ChartName parameter to CustomChart.aspx.,Solarwinds,Orion Network Performance Monitor,,,0.0034199999645352364,false,,false,false,false,,,false,false,,2011-08-24T10:00:00.000Z,0