Known vulnerabilities in Orion Network Performance Monitor

Vendor: SolarWinds
Software: Orion Network Performance Monitor
Software CPE: cpe:2.3:a:solarwinds:orion_network_performance_monitor:*:*:*:*:*:*:*:*
Website: https://www.solarwinds.com/
Total vulnerabilities: 11
Public exploits: 2
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Orion Network Performance Monitor Orion Network Performance Monitor is affected by 11 known vulnerabilities: 1 high, 6 medium, 4 low Critical High Medium Low

Vulnerabilities (11)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU57863 - Permissions, Privileges, and Access Controls
CVE-2021-35225		 CWE-264 Medium
No
No
 2020.2.6 HF2 02.11.2021 SB2021110223
#VU49924 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2020-27871		 CWE-22 Medium
No
No
 - 22.01.2021 SB2021012201
#VU49923 - Exposure of sensitive information to an unauthorized actor
CVE-2020-27870		 CWE-200 Medium
No
No
 - 22.01.2021 SB2021012201
#VU49922 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2020-27869		 CWE-89 Medium
No
No
 - 22.01.2021 SB2021012201
#VU49921 - Improper input validation
CVE-2020-14005		 CWE-20 Medium
No
No
 - 22.01.2021 SB2021012201
#VU49211 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-12863		 CWE-79 Low
No
No
 12.4 Hotfix 1 25.02.2020 SB2020022531
#VU25427 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-12954		 CWE-79 Low
No
No
 - 18.02.2020 SB2020021723
#VU17774 - Command injection
CVE-2019-8917		 CWE-77 High
No
No
 12.4 19.02.2019 SB2019021917
#VU43745 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2012-2577		 CWE-79 Low
Available
No
 - 12.08.2012 SB2012081203
#VU43746 - Cross-Site Request Forgery (CSRF)
CVE-2012-2602		 CWE-352 Medium
Available
No
 - 12.08.2012 SB2012081204
#VU44785 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2010-4828		 CWE-79 Low
No
No
 - 24.08.2011 SB2011082402