Netapp vulnerabilities
Published CVEs affecting Netapp products: 412 record(s), with severity, exploitation and fixes.
Active Iq Unified Manager 133H700s Firmware 108H300s Firmware 107H410s Firmware 107H500s Firmware 107Ontap Select Deploy Administration Utility 82Cloud Backup 81H410c Firmware 64Clustered Data Ontap 60Oncommand Insight 51Oncommand Workflow Automation 50Solidfire 43Hci Management Node 40Solidfire & Hci Management Node 39Steelstore Cloud Integrated Storage 38Snapcenter 35H700e Firmware 33H300e Firmware 32H500e Firmware 32Snapmanager 29Solidfire, Enterprise Sds & Hci Storage Node 24Bootstrap Os 23Clustered Data Ontap Antivirus Connector 18Hci Compute Node Firmware 17E-series Santricity Os Controller 17Service Level Manager 16Hci Bootstrap Os 15H610s Firmware 15Element Software 15Smi-s Provider 14Oncommand Shift 14Snap Creator Framework 12A250 Firmware 12Oncommand Unified Manager 12Solidfire Baseboard Management Controller Firmware 12Hci Compute Node 12Oncommand Api Services 12Oncommand Balance 11Solidfire & Hci Storage Node 11H610c Firmware 11
CVE-2019-3863
High · 8.8
CWE-787 Mar 25, 2019
A flaw was found in libssh2 before 1.8.1. A server could send a multiple keyboard interactive...
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.
CVE-2019-3858
Critical · 9.1
CWE-125 Mar 21, 2019
An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP...
An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
CVE-2019-3855
High · 8.8
CWE-190 Mar 21, 2019
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2...
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
CVE-2019-3862
Critical · 9.1
CWE-125 Mar 21, 2019
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way...
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
CVE-2019-3859
Critical · 9.1
CWE-125 Mar 21, 2019
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require...
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
CVE-2019-9169
Critical · 9.8
CWE-125 Feb 25, 2019
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has...
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.
CVE-2019-6110
Medium · 6.8
Public exploit CWE-838 Jan 31, 2019
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a...
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.
CVE-2019-6109
Medium · 6.8
CWE-116 Jan 31, 2019
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display...
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
CVE-2018-14719
Critical · 9.8
CWE-502 Jan 2, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
CVE-2018-14718
Critical · 9.8
CWE-502 Jan 2, 2019
Deserialization of Untrusted Data in Fasterxml Jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CVE-2018-0734
Medium · 5.9
CWE-327 Oct 30, 2018
Timing attack against DSA
The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).
CVE-2018-0735
Medium · 5.9
CWE-327 Oct 29, 2018
Timing attack against ECDSA signature generation
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).
CVE-2018-11784
Medium · 4.3
CWE-601 Oct 4, 2018
Apache Tomcat Open Redirect vulnerability
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
CVE-2018-14634
High · 7.8
KEV High · 69 Public exploit CWE-190 Sep 25, 2018
Linux Kernel Integer Overflow Vulnerability
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.
CVE-2018-11776
High · 8.1
KEV Urgent · 76 Public exploit Aug 22, 2018
Apache Struts Remote Code Execution Vulnerability
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
CVE-2018-11212
Medium · 6.5
CWE-369 May 16, 2018
An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows...
An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.
CVE-2018-8014
Critical · 9.8
CWE-1188 May 16, 2018
The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
CVE-2017-7525
Critical · 9.8
CWE-184 Feb 6, 2018
jackson-databind is vulnerable to a deserialization flaw
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
CVE-2017-15095
Critical · 9.8
CWE-502 Feb 6, 2018
Deserialization of Untrusted Data in Fasterxml Jackson-databind
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
CVE-2018-5968
High · 8.1
CWE-184 Jan 22, 2018
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated…
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
CVE-2017-12617
High · 8.1
KEV Urgent · 76 Public exploit CWE-434 Oct 3, 2017
Apache Tomcat Remote Code Execution Vulnerability
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVE-2017-12615
High · 8.1
KEV Urgent · 84 Public exploit Ransomware CWE-434 Sep 19, 2017
Apache Tomcat on Windows Remote Code Execution Vulnerability
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVE-2017-9805
High · 8.1
KEV Urgent · 76 Public exploit CWE-502 Sep 15, 2017
Apache Struts Deserialization of Untrusted Data Vulnerability
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
CVE-2016-6796
High · 7.5
Aug 10, 2017
A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to…
A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.
CVE-2016-6797
High · 7.5
CWE-863 Aug 10, 2017
Incorrect Authorization in Apache Software Foundation Tomcat
The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.