Netapp Ontap Tools vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Netapp Ontap Tools: 8 record(s), with affected versions and fixes.cpe:2.3:a:netapp:ontap_tools
CVE-2025-0167
Low · 3.4
Feb 5, 2025
netrc and default credential leak
When asked to use a `.netrc` file for credentials **and** to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.
This flaw only manifests itself if the netrc file has a `default` entry that
omits both login and password. A rare circumstance.
CVE-2024-52533
Critical · 9.8
CWE-120 Nov 11, 2024
gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer...
gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.
CVE-2024-8096
Medium · 6.5
CWE-295 Sep 11, 2024
OCSP stapling bypass with GnuTLS
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
CVE-2024-6387
High · 8.1
CWE-362 Jul 1, 2024
Openssh: regresshion - race condition in ssh allows rce/dos
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
CVE-2024-28757
High · 7.5
CWE-776 Mar 10, 2024
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of...
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
CVE-2023-2953
High · 7.5
CWE-476 May 30, 2023
A vulnerability was found in openldap. This security flaw causes a null pointer dereference in...
A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.
CVE-2021-44228
Critical · 10.0
KEV Urgent · 100 Public exploit Ransomware CWE-20 Dec 10, 2021
Apache Log4j2 Remote Code Execution Vulnerability
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
CVE-2021-3156
High · 7.8
KEV Urgent · 76 Public exploit CWE-193 Jan 26, 2021
Sudo Heap-Based Buffer Overflow Vulnerability
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.