Critical

DATE	CVE	VULNERABILITY TITLE	RISK
2021-08-31	CVE-2021-35222	Cross-site Scripting vulnerability in Solarwinds Orion Platform This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page. network low complexity solarwinds CWE-79 critical	9.6
2021-04-14	CVE-2021-27258	Unspecified vulnerability in Solarwinds Orion Platform 2020.2 This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion Platform 2020.2. network low complexity solarwinds critical	9.8
2021-02-03	CVE-2021-25274	Deserialization of Untrusted Data vulnerability in Solarwinds Orion Platform The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues. network low complexity solarwinds CWE-502 critical	9.8
2020-12-29	CVE-2020-10148	Improper Authentication vulnerability in Solarwinds Orion Platform 2019.4/2020.2/2020.2.1 The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. network low complexity solarwinds CWE-287 critical	9.8
2020-09-17	CVE-2020-13169	Cross-site Scripting vulnerability in Solarwinds Orion Platform Stored XSS (Cross-Site Scripting) exists in the SolarWinds Orion Platform before before 2020.2.1 on multiple forms and pages. network low complexity solarwinds CWE-79 critical	9.0
2019-03-01	CVE-2019-9546	Uncontrolled Search Path Element vulnerability in Solarwinds Orion Platform SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service. network low complexity solarwinds CWE-427 critical	9.8