Fkadibs

Name of the Vulnerable Software and Affected Versions: SolarWinds Network Performance Monitor (affected versions not specified) Description: The issue involves numerous exposed dangerous functions within Orion Core, allowing for read-only SQL injection and leading to privileged escalation. An attacker with low-user privileges may steal password hashes and password salt information. The vulnerability affects various functions, including SendHttpRequest, WriteToEventLog, SendSyslog, Email, CustomProperty, CustomStatus, SnmpTrap, PlaySound, and TextToSpeech. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SolarWinds Orion Platform (affected versions not specified) **Description** The issue is related to the "Log alert to a file" action within action management in the SolarWinds Orion Platform, which allows any user with Orion alert management rights to write to any file. This can be exploited by an attacker to perform an unrestricted file upload, potentially leading to remote code execution. The vulnerability is associated with an unlimited upload of dangerous file types, which can enable a remote attacker to elevate their privileges or execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.