CVE-2019-8917

SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote, unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method may be abused by an attacker to execute commands as the SYSTEM user.

• http://www.securityfocus.com/bid/107061Third Party Advisory, VDB Entry
• https://github.com/VerSprite/research/blob/master/advisories/VS-2019-001.mdThird Party Advisory
• http://www.securityfocus.com/bid/107061Third Party Advisory, VDB Entry
• https://github.com/VerSprite/research/blob/master/advisories/VS-2019-001.mdThird Party Advisory

Published

Feb 18, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-8907do_core_note in readelf.c in libmagic.a in file 5.35 allows …
• CVE-2019-8908An issue was discovered in WTCMS 1.0. It allows remote attac…
• CVE-2019-8909An issue was discovered in WTCMS 1.0. It allows remote attac…
• CVE-2019-8910An issue was discovered in WTCMS 1.0. It allows index.php?g=…
• CVE-2019-8911An issue was discovered in WTCMS 1.0. It has stored XSS via …
• CVE-2019-8912In the Linux kernel through 4.20.11, af_alg_release() in cry…7.8
• CVE-2019-8919The seadroid (aka Seafile Android Client) application throug…
• CVE-2019-8920iart.php in XAMPP 1.7.0 has XSS, a related issue to CVE-2008…
• CVE-2019-8921An issue was discovered in bluetoothd in BlueZ through 5.48.…6.5
• CVE-2019-8922A heap-based buffer overflow was discovered in bluetoothd in…8.8
• CVE-2019-8923XAMPP through 5.6.8 and previous allows SQL injection via th…
• CVE-2019-8924XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpre…