Nhiephon

SolarWinds Web Help Desk is susceptible to an XML External Entity (XXE) injection issue that may result in information disclosure. Successful exploitation requires valid, low-privilege access, or access to the local server to modify configuration files.

The issue is related to a SQL injection vulnerability. It can be exploited via the `offset` parameter at the "requests.php?f=search&s=recipients" endpoint.

The issue is related to a SQL injection vulnerability. It can be exploited via the `offset` parameter at the "requests.php?f=load-my-blogs" endpoint.

The issue allows a user-mode write access violation. This occurs starting at `FORMATS!GetPlugInInfo+0x0000000000007e30`.

The issue allows a user-mode write access violation. This occurs at the FORMATS!GetPlugInInfo+0x0000000000007e62 location.

The issue allows a user-mode write access violation. This violation occurs at the `GetPlugInInfo()` function.

The issue allows a user-mode write access violation. This violation occurs at the FORMATS!GetPlugInInfo+0x0000000000007e20 location.

The issue allows a user-mode write access violation. This occurs at the FORMATS!GetPlugInInfo+0x0000000000007e6e location.

The issue allows a user-mode write access violation. This occurs at the FORMATS!GetPlugInInfo+0x0000000000007e28 location.

The issue allows a user-mode write access violation. This occurs at the FORMATS!ShowPlugInSaveOptions W+0x000000000000755d location.

The issue allows a user-mode write access violation. This occurs starting at FORMATS!ShowPlugInSaveOptions W+0x0000000000007f4b.

The issue allows a user-mode write access violation. This occurs within the ShowPlugInSaveOptions W function.

The issue allows a user-mode write access violation. This occurs at the FORMATS!ShowPlugInSaveOptions W+0x000000000001bcab location.

The issue allows a user-mode write access violation. This occurs starting at FORMATS!GetPlugInInfo+0x0000000000007e82.