Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35220 - https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-EmailWebPage-Command-Injection-RCE-CVE-2021-35220?language=en_US - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm
CVE ID: CVE-2021-35221 State: PUBLISHED Published: 2021-08-31T12:13:04 Last Updated: 2024-08-04T00:33:51.282Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: SolarWinds Products: Orion Platform Problem Types: CWE-284 Description: Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm - https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US - htt
ation.htm - https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35221 - https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-ImportAlert-Improper-Access-Control-Tampering-Vulnerability-CVE-2021-35221?language=en_US
CVE ID: CVE-2021-35222 State: PUBLISHED Published: 2021-08-31T12:14:34 Last Updated: 2024-08-04T00:33:51.294Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L) Vendors: SolarWinds Products: Orion Platform Problem Types: CWE-79 Description: This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm - https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US - htt
ation.htm - https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35222 - https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-Resource-aspx-Reflected-Cross-Site-Scripting-Vulnerability-CVE-2021-35222?language=en_US
CVE ID: CVE-2021-35223 State: PUBLISHED Published: 2021-08-31T16:00:18 Last Updated: 2024-08-04T00:33:51.260Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SolarWinds Products: Serv-U Problem Types: CWE-20 Description: The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/article/Execute-Command-Function-Allows-Remote-Code-Execution-RCE-Vulnerability-CVE-2021-35223?languag
m/SuccessCenter/s/article/Execute-Command-Function-Allows-Remote-Code-Execution-RCE-Vulnerability-CVE-2021-35223?language=en_US - https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-2-4_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35223
CVE ID: CVE-2021-35225 State: PUBLISHED Published: 2021-10-21T17:39:59.717660Z Last Updated: 2024-09-17T00:11:06.373Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: SolarWinds Products: NPM Problem Types: Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5 Description: Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwi
data cross-contamination. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm - https://support.solarwinds.com/SuccessCenter/s/article/NPM-2020-2-6-Hotfix-2?language=en_US - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35225
CVE ID: CVE-2021-35226 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-04T00:33:51.270Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SolarWinds Products: Network Configuration Manager Problem Types: CWE-326 Description: An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). Exposed credentials are encrypted and require authenticated access with an NCM role. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35226
CVE ID: CVE-2021-35227 State: PUBLISHED Published: 2021-10-21T17:41:34.442595Z Last Updated: 2024-09-16T23:15:48.252Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SolarWinds Products: Access Rights Manager Problem Types: CWE-79 Description: The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35227 - https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2021-4_release_notes.htm
CVE ID: CVE-2021-35228 State: PUBLISHED Published: 2021-10-21T17:43:01.468493Z Last Updated: 2024-09-16T23:56:04.954Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: SolarWinds Products: SolarWinds Problem Types: Reflected cross site scripting affecting SolarWinds: DPA 2021.3.7388 Description: This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attack in order to change header for a remote victim. Additional Analyst Notes: - CVE Program Container: References:
le attack in order to change header for a remote victim. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35228 - https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2021-3-7438_release_notes.htm
CVE ID: CVE-2021-35229 State: PUBLISHED Published: 2022-04-21T18:18:14.670970Z Last Updated: 2024-09-16T22:20:32.614Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: SolarWinds Products: Database Performance Monitor Problem Types: CWE-79 Description: Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL query Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35229 - https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2022-2_release_notes.htm
CVE ID: CVE-2021-35230 State: PUBLISHED Published: 2021-10-22T11:19:25.221806Z Last Updated: 2024-09-16T18:39:55.907Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Kiwi CatTools Problem Types: CWE-22 Description: As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35230
CVE ID: CVE-2021-35231 State: PUBLISHED Published: 2021-10-25T13:00:29.724380Z Last Updated: 2024-09-16T18:38:19.541Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Kiwi Syslog Server Problem Types: CWE-428 Description: As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry. Example vulnerable path: "Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Kiwi Syslog Server\Parameters\Application". Additional Analyst Notes: - CVE Program Container: Re
ControlSet001\Services\Kiwi Syslog Server\Parameters\Application". Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35231 - https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm
CVE ID: CVE-2021-35232 State: PUBLISHED Published: 2021-12-27T18:48:18.158328Z Last Updated: 2024-09-17T03:44:02.601Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: SolarWinds Products: Web Help Desk Problem Types: CWE-798 Description: Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users or insert arbitrary data into the database. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.
bitrary data into the database. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35232 - https://support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-7-Hotfix-1-Release-Notes?language=en_US
CVE ID: CVE-2021-35233 State: PUBLISHED Published: 2021-10-27T00:51:36.164224Z Last Updated: 2024-09-16T16:33:00.126Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SolarWinds Products: Kiwi Syslog Server Problem Types: CWE-16 Description: The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was received in the response to the client. This may lead to the disclosure of sensitive information such as internal authentication headers appended by reverse proxies. A
y lead to the disclosure of sensitive information such as internal authentication headers appended by reverse proxies. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35233
CVE ID: CVE-2021-35234 State: PUBLISHED Published: 2021-12-20T20:08:25.522543Z Last Updated: 2024-09-16T18:59:20.905Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SolarWinds Products: Orion Core Problem Types: CWE-89 Description: Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker with low-user privileges may steal password hashes and password salt information. Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3 - https://documentation.solarwinds.com/en/Success_Center/orion
/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3 - https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35234 - https://www.zerodayinitiative.com/advisories/ZDI-21-1598/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1596/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1604/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1600/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1601/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1602/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1597/ - https://www.zerodayinitiative.com/
advisories/ZDI-21-1602/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1597/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1599/ - https://www.zerodayinitiative.com/advisories/ZDI-21-1603/
CVE ID: CVE-2021-35235 State: PUBLISHED Published: 2021-10-27T00:55:43.038021Z Last Updated: 2024-09-17T04:19:18.102Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SolarWinds Products: Kiwi Syslog Server Problem Types: CWE-11 Description: The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if configured to do so. Debug mode causes ASP.NET to compile applications with extra information. The information enables a debugger to closely monitor and control the execution of an application. If an attacker could successfully start a remote debugging session, this is
nd control the execution of an application. If an attacker could successfully start a remote debugging session, this is likely to disclose sensitive information about the web application and supporting infrastructure that may be valuable in targeting SWI with malicious intent. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35235
CVE ID: CVE-2021-35236 State: PUBLISHED Published: 2021-10-27T00:57:02.178772Z Last Updated: 2024-09-16T21:56:34.503Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: SolarWinds Products: Kiwi Syslog Server Problem Types: CWE-614 Description: The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP, there is a potential for the cookie can be sent in clear text. Additiona
the application can be accessed over both HTTP, there is a potential for the cookie can be sent in clear text. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35236
CVE ID: CVE-2021-35237 State: PUBLISHED Published: 2021-10-29T13:32:18.489198Z Last Updated: 2024-09-16T22:50:51.483Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: SolarWinds Products: Kiwi Syslog Server Problem Types: CWE-1021 Description: A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server
ich they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server. This is an attack on both the user and the server. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kss_9-8_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35237
CVE ID: CVE-2021-35238 State: PUBLISHED Published: 2021-09-01T11:02:35 Last Updated: 2024-08-04T00:33:51.272Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: SolarWinds Products: Orion Platform Problem Types: CWE-79 Description: User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm - https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US - https://www.solarwinds.com/trust-center/sec
om/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35238
CVE ID: CVE-2021-35239 State: PUBLISHED Published: 2021-08-31T15:56:08 Last Updated: 2024-08-04T00:33:51.271Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: SolarWinds Products: Orion Platform Problem Types: CWE-79 Description: A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm - https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US - https://www.solarwinds.com/trust-center/security
ccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35239 - https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-Stored-XSS-in-Maps-text-box-hyperlink-vulnerability-CVE-2021-35239?language=en_US
CVE ID: CVE-2021-35240 State: PUBLISHED Published: 2021-08-31T15:57:21 Last Updated: 2024-08-04T00:33:51.240Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L) Vendors: SolarWinds Products: Orion Platform Problem Types: CWE-79 Description: A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm - https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US - https:
on.htm - https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_US - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35240 - https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-Stored-XSS-via-Help-Server-setting-CVE-2021-35240?language=en_US
CVE ID: CVE-2021-35242 State: PUBLISHED Published: 2021-12-06T16:53:22 Last Updated: 2024-08-04T00:33:51.281Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: SolarWinds Products: Serv-U Server Problem Types: CWE-352 Description: Serv-U server responds with valid CSRFToken when the request contains only Session. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-2-5_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35242
CVE ID: CVE-2021-35243 State: PUBLISHED Published: 2021-12-23T19:48:34.603987Z Last Updated: 2024-09-16T17:18:45.942Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: SolarWinds Products: Web Help Desk Problem Types: CWE-749 Description: The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests. The HTTP PUT method is normally used to upload data that is saved on the server with a user-supplied URL. While the DELETE method requests that the origin server removes the association between the target resource and its current functionality. Improper use of these methods may
er removes the association between the target resource and its current functionality. Improper use of these methods may lead to a loss of integrity. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35243 - https://support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-7-Hotfix-1-Release-Notes?language=en_US
CVE ID: CVE-2021-35244 State: PUBLISHED Published: 2021-12-20T20:08:24.786551Z Last Updated: 2024-09-16T22:10:26.291Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L) Vendors: SolarWinds Products: Orion Platform Problem Types: https://cwe.mitre.org/data/definitions/1031.html Description: The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/
ng a remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35242 - https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-secure-configuration.htm - https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-3?language=en_US - https://www.zerodayinitiative.com/advisories/ZDI-22-375/
CVE ID: CVE-2021-35245 State: PUBLISHED Published: 2021-12-06T16:52:02.411115Z Last Updated: 2024-09-17T02:15:45.584Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: SolarWinds Products: Serv-U FTP Problem Types: CWE-284 Description: When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35245 - https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-2-5_release_notes.htm
CVE ID: CVE-2021-35246 State: PUBLISHED Published: 2022-11-23T16:48:18.061Z Last Updated: 2025-04-25T18:18:44.414Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SolarWinds Products: Engineer's Toolset Problem Types: CWE-319 Description: The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could bypass the application's use of SSL/TLS encryption and use the application as a platform for attacks against its users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisori
CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35246 - https://documentation.solarwinds.com/en/success_center/ets/content/release_notes/ets_2022-4_release_notes.htm - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35246
CVE ID: CVE-2021-35247 State: PUBLISHED Published: 2022-01-07T22:39:50.564Z Last Updated: 2025-10-21T23:15:49.752Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: SolarWinds Products: Serv-U Problem Types: CWE-20 Description: Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of