Netapp Steelstore Cloud Integrated Storage vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Netapp Steelstore Cloud Integrated Storage: 38 record(s), with affected versions and fixes.cpe:2.3:a:netapp:steelstore_cloud_integrated_storage
CVE-2019-17267
Critical · 9.8
CWE-502 Oct 6, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
CVE-2019-16943
Critical · 9.8
CWE-502 Oct 1, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
CVE-2019-16942
Critical · 9.8
CWE-502 Oct 1, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
CVE-2019-5482
Critical · 9.8
CWE-787 Sep 16, 2019
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVE-2019-16335
Critical · 9.8
CWE-502 Sep 15, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
CVE-2019-14540
Critical · 9.8
CWE-502 Sep 15, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-16168
Medium · 6.5
CWE-369 Sep 9, 2019
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other...
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
CVE-2019-13272
High · 7.8
KEV Urgent · 76 Public exploit Jul 17, 2019
Linux Kernel Improper Privilege Management Vulnerability
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
CVE-2019-5436
High · 7.8
CWE-787 May 28, 2019
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in...
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
CVE-2019-9169
Critical · 9.8
CWE-125 Feb 25, 2019
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has...
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.
CVE-2018-14719
Critical · 9.8
CWE-502 Jan 2, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
CVE-2018-14718
Critical · 9.8
CWE-502 Jan 2, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CVE-2016-9841
Critical · 9.8
May 23, 2017
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified…
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.