Solarwinds
Solarwinds N-central: vulnerabilidades y CVE
Solarwinds N-central tiene 9 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE9
Últimos 12 meses0
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2020-25622 | Alta (8.8) | 0.96% | — | 16 dic 2020 | An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF. |
| CVE-2020-25621 | Alta (8.4) | 0.54% | — | 16 dic 2020 | An issue was discovered in SolarWinds N-Central 12.3.0.670. The local database does not require authentication: security is only based on ability to access a network interface. The database has keys and passwords. |
| CVE-2020-25620 | Alta (7.8) | 0.43% | — | 16 dic 2020 | An issue was discovered in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by default for local user accounts named support@n-able.com and nableadmin@n-able.com. These allow logins to the N-Central… |
| CVE-2020-25619 | Media (4.4) | 0.45% | — | 16 dic 2020 | An issue was discovered in SolarWinds N-Central 12.3.0.670. The SSH component does not restrict the Communication Channel to Intended Endpoints. An attacker can leverage an SSH feature (port forwarding with a temporary… |
| CVE-2020-25618 | Alta (8.8) | 2.7% | — | 16 dic 2020 | An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access control because the nable web user account is effectively able to run arbitrary OS commands as root (i.e., the use… |
| CVE-2020-25617 | Alta (8.8) | 3.3% | — | 16 dic 2020 | An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows Relative Path Traversal by an authenticated user of the N-Central Administration Console (NAC), leading to execution… |
| CVE-2020-15910 | Media (4.7) | 5.6% | — | 19 oct 2020 | SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or… |
| CVE-2020-15909 | Alta (8.8) | 2.2% | — | 19 oct 2020 | SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA… |
| CVE-2020-7984 | Alta (7.5) | 2.5% | — | 26 ene 2020 | SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe settings, and obtain other sensitive information. The… |
Otros productos de Solarwinds
Serv-u · 55Orion Platform · 49Access Rights Manager · 33Solarwinds Platform · 27WEB Help Desk · 22Serv-u File Server · 20Database Performance Analyzer · 11Serv-u FTP Server · 11Observability Self-hosted · 10Orion Network Performance Monitor · 9Network Performance Monitor · 8Dameware Mini Remote Control · 8