Vulnerabilities > Solarwinds > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-03-21 | CVE-2018-15906 | Unspecified vulnerability in Solarwinds Serv-U FTP Server 15.1.6 SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Import feature and modifying a CSV file. | 7.2 |
| 2018-09-07 | CVE-2018-12897 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Solarwinds Dameware Mini Remote Control SolarWinds DameWare Mini Remote Control before 12.1 has a Buffer Overflow. | 7.8 |
| 2018-05-16 | CVE-2018-10240 | Insufficient Entropy vulnerability in Solarwinds Serv-U SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. | 7.3 |
| 2017-04-10 | CVE-2017-7647 | Unspecified vulnerability in Solarwinds LOG & Event Manager 6.3.1 SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to execute arbitrary commands. | 8.8 |
| 2017-03-24 | CVE-2017-5199 | Incorrect Permission Assignment for Critical Resource vulnerability in Solarwinds LOG and Event Manager The editbanner feature in SolarWinds LEM (aka SIEM) through 6.3.1 allows remote authenticated users to execute arbitrary code by editing /usr/local/contego/scripts/mgrconfig.pl. | 8.8 |
| 2017-03-24 | CVE-2017-5198 | Unspecified vulnerability in Solarwinds LOG and Event Manager SolarWinds LEM (aka SIEM) before 6.3.1 has an incorrect sudo configuration, which allows local users to obtain root access by editing /usr/local/contego/scripts/hostname.sh. | 8.8 |
| 2017-03-20 | CVE-2017-6803 | Cross-Site Request Forgery (CSRF) vulnerability in Solarwinds FTP Voyager 16.2.0 Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds (formerly Serv-U) FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that (1) change the admin password, (2) terminate the scheduler, or (3) possibly execute arbitrary commands via crafted requests to Admin/XML/Result.xml. | 8.8 |
| 2016-06-17 | CVE-2016-3643 | Permissions, Privileges, and Access Controls vulnerability in Solarwinds Virtualization Manager 6.3.1 SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd." | 7.8 |