SolarWinds Kiwi Syslog Server vulnerabilities

5 CVEs affecting SolarWinds Kiwi Syslog Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-35237, published 2021-10-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-35235, published 2021-10-27. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if configured to do so. Debug mode causes…
CVE-2021-35233, published 2021-10-27. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that…
CVE-2021-35237, published 2021-10-29. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a…
CVE-2021-35236, published 2021-10-27. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a…
CVE-2021-35231, published 2021-10-25. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path…