SolarWinds Kiwi Syslog Server
By the Year
In 2024 there have been 0 vulnerabilities in SolarWinds Kiwi Syslog Server . Kiwi Syslog Server did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 5 | 5.38 |
| 2020 | 0 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Kiwi Syslog Server vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent SolarWinds Kiwi Syslog Server Security Vulnerabilities
A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking
CVE-2021-35237
4.3 - Medium
- October 29, 2021
A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server. This is an attack on both the user and the server.
Clickjacking
The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier
CVE-2021-35233
5.3 - Medium
- October 27, 2021
The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was received in the response to the client. This may lead to the disclosure of sensitive information such as internal authentication headers appended by reverse proxies.
The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions
CVE-2021-35236
5.3 - Medium
- October 27, 2021
The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP, there is a potential for the cookie can be sent in clear text.
Missing Encryption of Sensitive Data
The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions
CVE-2021-35235
5.3 - Medium
- October 27, 2021
The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if configured to do so. Debug mode causes ASP.NET to compile applications with extra information. The information enables a debugger to closely monitor and control the execution of an application. If an attacker could successfully start a remote debugging session, this is likely to disclose sensitive information about the web application and supporting infrastructure that may be valuable in targeting SWI with malicious intent.
As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard
CVE-2021-35231
6.7 - Medium
- October 25, 2021
As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry. Example vulnerable path: "Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Kiwi Syslog Server\Parameters\Application".
Unquoted Search Path or Element
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for SolarWinds Kiwi Syslog Server or by SolarWinds? Click the Watch button to subscribe.
