Vulnerabilidades de Netapp
CVEs publicadas que afetam produtos de Netapp: 411 registro(s), com severidade, exploração e correções.
Active Iq Unified Manager 133H700s Firmware 108H300s Firmware 107H410s Firmware 107H500s Firmware 107Ontap Select Deploy Administration Utility 82Cloud Backup 81H410c Firmware 64Clustered Data Ontap 59Oncommand Insight 51Oncommand Workflow Automation 50Solidfire 43Hci Management Node 40Solidfire & Hci Management Node 39Steelstore Cloud Integrated Storage 38Snapcenter 35H700e Firmware 33H300e Firmware 32H500e Firmware 32Snapmanager 29Solidfire, Enterprise Sds & Hci Storage Node 24Bootstrap Os 23Clustered Data Ontap Antivirus Connector 18Hci Compute Node Firmware 17E-series Santricity Os Controller 17Service Level Manager 16Hci Bootstrap Os 15H610s Firmware 15Element Software 15Smi-s Provider 14Oncommand Shift 14Snap Creator Framework 12A250 Firmware 12Oncommand Unified Manager 12Solidfire Baseboard Management Controller Firmware 12Hci Compute Node 12Oncommand Api Services 12Oncommand Balance 11Solidfire & Hci Storage Node 11H610c Firmware 11
CVE-2016-5018
Crítica · 9.1
10/08/2017
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to…
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
CVE-2016-0762
Média · 5.9
CWE-203 10/08/2017
Observable Discrepancy em Apache Software Foundation Tomcat
The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.
CVE-2016-9841
Crítica · 9.8
23/05/2017
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified…
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
CVE-2017-5645
Crítica · 9.8
Exploit público CWE-502 17/04/2017
Deserialization of Untrusted Data em Apache Software Foundation Log4j
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVE-2016-8735
Crítica · 9.8
KEV Alta · 63 06/04/2017
Apache Tomcat Remote Code Execution Vulnerability
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
CVE-2017-5638
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-755 10/03/2017
Apache Struts Remote Code Execution Vulnerability
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CVE-2016-10165
Alta · 7.1
CWE-125 03/02/2017
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to...
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
CVE-2016-5195
Alta · 7.0
KEV Urgente · 70 Exploit público CWE-362 10/11/2016
Linux Kernel Race Condition Vulnerability
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
CVE-2016-3427
Crítica · 9.8
KEV Alta · 63 CWE-284 21/04/2016
Oracle Java SE and JRockit Unspecified Vulnerability
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVE-2015-5477
Alta · 7.5
KEV Urgente · 79 Exploit público CWE-19 29/07/2015
ISC BIND Data Processing Errors Vulnerability
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
CVE-2010-1871
Alta · 8.8
KEV Urgente · 76 Exploit público CWE-917 05/08/2010
Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.