SolarWinds Orion Platform vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 202115
3. 20228

Known exploitedNewest addition to KEV first

• CVE-2020-10148

  SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

  SolarWinds · Orion Platform

  ExploitedCritical9.8

Newest CVEs

• CVE-2022-36964

  SolarWinds Platform Deserialization of Untrusted Data

  SolarWinds · SolarWinds Platform

  High8.8
• CVE-2022-36962

  SolarWinds Platform Command Injection

  SolarWinds · SolarWinds Platform

  High7.2
• CVE-2022-36960

  SolarWinds Platform Improper Input Validation

  SolarWinds · SolarWinds Platform

  High8.8
• CVE-2022-38108

  SolarWinds Platform Deserialization of Untrusted Data

  SolarWinds · SolarWinds Platform

  High7.2
• CVE-2022-36958

  SolarWinds Platform Deserialization of Untrusted Data

  SolarWinds · SolarWinds Platform

  High8.8
• CVE-2022-36957

  SolarWinds Platform Deserialization of Untrusted Data

  SolarWinds · SolarWinds Platform

  High7.2
• CVE-2022-36965

  Stored and DOM XSS in QoE Applications: Orion Platform

  SolarWinds · Orion Platform

  Medium6.1
• CVE-2022-36961

  Orion Platform SQL Injection Privilege Escalation Vulnerability

  SolarWinds · Orion Platform

  High8.8
• CVE-2021-35244

  Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6

  SolarWinds · Orion Platform

  Medium6.8
• CVE-2021-35217

  Insecure Deserialization of untrusted data causing Remote code execution vulnerability.

  SolarWinds · Orion Platform

  High8.9