Frank Lycops

A broken authorization schema allows low-privileged users to access and modify information that exceeds their assigned permissions.

SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.

SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations.

Tanium Client is subject to a denial of service condition. The vulnerability allows for a denial of service.

Tanium Threat Response contains an information disclosure issue.

An improper input validation issue exists in Tanium Appliance.

Tanium Threat Response contains an information disclosure issue. The vulnerability allows for the potential exposure of information.

Tanium Threat Response contains an information disclosure issue. The vulnerability allows for the potential exposure of information.

The issue is related to a lack of protection for the web page structure in the Search/Node Information Section component of the SolarWinds Platform user interface. This allows a remote attacker to conduct cross-site scripting (XSS) attacks. The vulnerability requires authentication and user interaction.

A local file deletion issue in the software enables an authenticated administrator to delete files from the local file system with elevated privileges. These files can include logs and system components that impact the integrity and availability of the software.

The issue allows remote attackers to cause a denial of service, create arbitrary users, or possibly have other unspecified impacts via a crafted request to the "/upnpisapi" endpoint, specifically by using the "beckhoff.com:service:cxconfig:1#Write" SOAP action.