SolarWinds Orion Network Performance Monitor vulnerabilities

9 CVEs affecting SolarWinds Orion Network Performance Monitor, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-14007, published 2020-06-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-9566, published 2015-03-10. High severity, CVSS 7.5. EPSS: 47.7% chance of exploitation in the next 30 days. Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor (NPM) before…
CVE-2019-8917, published 2019-02-18. Critical severity, CVSS 9.8. EPSS: 36.4% chance of exploitation in the next 30 days. SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote,…
CVE-2020-14005, published 2020-06-24. High severity, CVSS 8.8. EPSS: 14.3% chance of exploitation in the next 30 days. Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code via a defined event.
CVE-2012-2577, published 2012-08-12. Medium severity, CVSS 4.3. EPSS: 10.2% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1)…
CVE-2012-4939, published 2012-10-31. Medium severity, CVSS 4.3. EPSS: 7.2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject…
CVE-2012-2602, published 2012-08-12. Medium severity, CVSS 6.8. EPSS: 6% chance of exploitation in the next 30 days. Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers to hijack the authentication of administrators…
CVE-2010-4828, published 2011-08-24. Medium severity, CVSS 4.3. EPSS: 5.1% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) 10.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Title…
CVE-2020-14007, published 2020-06-24. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a name of an alert definition.
CVE-2020-14006, published 2020-06-24. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a Responsible Team.