Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
n-central vulnerabilities and exploits
(subscribe to this query)
8.8
CVSSv3
CVE-2020-15909
SolarWinds N-central up to and including 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in wit...
Solarwinds N-central
4.7
CVSSv3
CVE-2020-15910
SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This ...
Solarwinds N-central
7.5
CVSSv3
CVE-2020-7984
SolarWinds N-central prior to 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote malicious users to retrieve cleartext domain admin credentials from the Agent & Probe settings, and obtain other sensitive information. The attacker can use a customer ID to self register and rea...
Solarwinds N-central
1 Github repository
9.8
CVSSv3
CVE-2023-47132
An issue discovered in N-able N-central prior to 2023.6 and previous versions allows malicious users to gain escalated privileges via API calls.
N-able N-central
7.8
CVSSv3
CVE-2020-25620
An issue exists in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by default for local user accounts named support@n-able.com and nableadmin@n-able.com. These allow logins to the N-Central Administrative Console (NAC) and/or the regular web interface.
Solarwinds N-central 12.3.0.670
8.8
CVSSv3
CVE-2020-25617
An issue exists in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows Relative Path Traversal by an authenticated user of the N-Central Administration Console (NAC), leading to execution of OS commands as root.
Solarwinds N-central 12.3.0.670
8.8
CVSSv3
CVE-2020-25618
An issue exists in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access control because the nable web user account is effectively able to run arbitrary OS commands as root (i.e., the use of root privileges is not limited to specific programs listed in the ...
Solarwinds N-central 12.3.0.670
4.4
CVSSv3
CVE-2020-25619
An issue exists in SolarWinds N-Central 12.3.0.670. The SSH component does not restrict the Communication Channel to Intended Endpoints. An attacker can leverage an SSH feature (port forwarding with a temporary key pair) to access network services on the 127.0.0.1 interface, even...
Solarwinds N-central 12.3.0.670
8.4
CVSSv3
CVE-2020-25621
An issue exists in SolarWinds N-Central 12.3.0.670. The local database does not require authentication: security is only based on ability to access a network interface. The database has keys and passwords.
Solarwinds N-central 12.3.0.670
8.8
CVSSv3
CVE-2020-25622
An issue exists in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF.
Solarwinds N-central 12.3.0.670
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322
cross-site request forgery
unauthorized
CVE-2024-33925
reflected XSS
CVE-2023-51580
CVE-2023-51579
CVE-2015-2051
CVE-2023-51609
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »