OP
IT Management
Orion Platform
On CISA KEVExploited in the wild
50
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 28Medium 16Low 0
Watch
Add Orion Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-36964 | 8.8 | Nov 29 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data Affected: before 2020.2.6; 2020.2.6; 2020.2.6; 2020.2.6; 2020.2.6; 2020.2.6; +3 more |
| CVE-2022-36960 | 8.8 | Nov 29 | SolarWinds Platform was susceptible to Improper Input Validation Affected: before 2020.2.6; 2020.2.6; 2020.2.6; 2020.2.6; 2020.2.6; 2020.2.6; +3 more |
| CVE-2022-36958 | 8.8 | Oct 20 | SolarWinds Platform Deserialization of Untrusted Data Affected: through 2020.2.6 HF5 and prior versions |
| CVE-2022-36961 | 8.8 | Sep 30 | Orion Platform SQL Injection Privilege Escalation Vulnerability Affected: 2022.2.3 and previous versions before 2022.2.3 |
| CVE-2021-35234 | 8.8 | Dec 20 | Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation Affected: through 2020.2.5; 2020.2.6; 2020.2.6; 2020.2.6 |
| CVE-2021-35218 | 8.8 | Sep 1 | Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution Affected: before 2020.2.6 |
| CVE-2021-35215 | 8.8 | Sep 1 | Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5 Affected: through 2020.2.5 |
| CVE-2021-35212 | 8.8 | Aug 31 | An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team Affected: 2019.2; 2019.4; 2020.2.1; 2020.2.4; 2020.2.5 |
| CVE-2021-35213 | 8.8 | Aug 31 | An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5 Affected: through 2020.2.5 |
| CVE-2021-35221 | 8.1 | Aug 31 | Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page Affected: before 2020.2.6 |
| CVE-2022-47505 | 7.8 | Apr 21 | The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability Affected: before 2023.2 |
| CVE-2022-47506 | 7.8 | Feb 15 | SolarWinds Platform was susceptible to the Directory Traversal Vulnerability Affected: 2022.4.1 |
| CVE-2021-27277 | 7.8 | Apr 22 | This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual Infrastructure Monitor 2020.2 Affected: 2020.2 |
| CVE-2021-25275 | 7.8 | Feb 3 | SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores database credentials to access this backend… Affected: before 2020.2.4 |
| CVE-2023-23845 | 7.2 | Sep 13 | The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability Affected: before 2023.3.1 |
| CVE-2023-23840 | 7.2 | Sep 13 | The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability Affected: before 2023.3.1 |
| CVE-2022-36963 | 7.2 | Apr 21 | The SolarWinds Platform was susceptible to the Command Injection Vulnerability Affected: before 2023.2 |
| CVE-2023-23836 | 7.2 | Feb 15 | SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data Affected: 2022.4.1 |
| CVE-2022-47507 | 7.2 | Feb 15 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data Affected: 2022.4.1 |
| CVE-2022-47504 | 7.2 | Feb 15 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data Affected: 2022.4.1 |
| CVE-2022-47503 | 7.2 | Feb 15 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data Affected: 2022.4.1 |
| CVE-2022-38111 | 7.2 | Feb 15 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data Affected: 2022.4.1 |
| CVE-2022-36962 | 7.2 | Nov 29 | SolarWinds Platform was susceptible to Command Injection Affected: before 2020.2.6; 2020.2.6; 2020.2.6; 2020.2.6; 2020.2.6; 2020.2.6; +3 more |
| CVE-2022-38108 | 7.2 | Oct 20 | SolarWinds Platform Deserialization of Untrusted Data Affected: through 2020.2.6 HF5 and prior versions |
| CVE-2022-36957 | 7.2 | Oct 20 | SolarWinds Platform Deserialization of Untrusted Data Affected: through 2020.2.6 HF5 and prior versions |
| CVE-2021-35244 | 7.2 | Dec 20 | The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file Affected: before 2020.2.6; 2020.2.6; 2020.2.6; 2020.2.6 |
| CVE-2021-35220 | 7.2 | Aug 31 | Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page Affected: before 2020.2.6 |
| CVE-2020-27871 | 7.2 | Feb 10 | This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1 Affected: 2020.2.1 |
Showing 28