NLIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Kwetsbaarheden verholpen in Solarwinds Platform
Advisory ansehen veröffentlicht 2024-06-07
Solarwinds heeft kwetsbaarheden verholpen in Solarwinds Platform.
01
beschreibt (14)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-29004US | medium4.3 | — | ||
The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is requi… | ||||
| CVE-2024-28999US | high7.5 | Exploit | ||
The SolarWinds Platform was determined to be affected by a Race Condition Vulnerability affecting the web console. | ||||
| CVE-2024-28996US | high7.5 | — | ||
The SolarWinds Platform was determined to be affected by a SWQL Injection Vulnerability. Attack complexity is high for this vulnerability.
| ||||
| CVE-2021-4321US | medium4.3 | — | ||
Policy bypass in Blink in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2023-0286US | high7.4 | — | ||
There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure def… | ||||
| CVE-2023-0215US | high7.5 | — | ||
The public API function BIO_new_NDEF is a helper function used for streaming
ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the
SMIME, CMS and PKCS7 st… | ||||
| CVE-2022-0778US | high7.5 | Exploit | ||
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsi… | ||||
| CVE-2021-3712US | high7.4 | Exploit | ||
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This cont… | ||||
| CVE-2021-23840US | high7.5 | Exploit | ||
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable… | ||||
| CVE-2020-1971US | medium5.9 | Exploit | ||
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_c… | ||||
| CVE-2019-1559US | medium5.9 | — | ||
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently… | ||||
| CVE-2018-0732US | high7.5 | — | ||
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an u… | ||||
| CVE-2018-0737US | medium5.9OT erhöht | — | ||
The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks dur… | ||||
| CVE-2017-3736US | medium6.5 | — | ||
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Reference - cveprojectv5; nvdexternal
- Reference - cveprojectv5; nvdexternal
- Reference - cveprojectv5; nvdexternal
- Reference - cveprojectv5; nvdexternal
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan