Vulnerabilidades de Netapp

CVEs publicadas que afetam produtos de Netapp: 411 registro(s), com severidade, exploração e correções.

Active Iq Unified Manager 133 H700s Firmware 108 H300s Firmware 107 H410s Firmware 107 H500s Firmware 107 Ontap Select Deploy Administration Utility 82 Cloud Backup 81 H410c Firmware 64 Clustered Data Ontap 59 Oncommand Insight 51 Oncommand Workflow Automation 50 Solidfire 43 Hci Management Node 40 Solidfire & Hci Management Node 39 Steelstore Cloud Integrated Storage 38 Snapcenter 35 H700e Firmware 33 H300e Firmware 32 H500e Firmware 32 Snapmanager 29 Solidfire, Enterprise Sds & Hci Storage Node 24 Bootstrap Os 23 Clustered Data Ontap Antivirus Connector 18 Hci Compute Node Firmware 17 E-series Santricity Os Controller 17 Service Level Manager 16 Hci Bootstrap Os 15 H610s Firmware 15 Element Software 15 Smi-s Provider 14 Oncommand Shift 14 Snap Creator Framework 12 A250 Firmware 12 Oncommand Unified Manager 12 Solidfire Baseboard Management Controller Firmware 12 Hci Compute Node 12 Oncommand Api Services 12 Oncommand Balance 11 Solidfire & Hci Storage Node 11 H610c Firmware 11

Somente exploradas (KEV) →

CVE-2021-34866 Alta · 7.8 CWE-843 25/01/2022

This vulnerability allows local attackers to escalate privileges on affected installations of...

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs, which can result in a type confusion condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-14689.

CVE-2022-23437 Média · 6.5 CWE-835 24/01/2022

Infinite loop within Apache XercesJ xml parser

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

CVE-2022-23852 Crítica · 9.8 CWE-190 23/01/2022

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for...

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

CVE-2021-46143 Alta · 7.8 CWE-190 06/01/2022

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for...

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

CVE-2021-45960 Alta · 8.8 CWE-682 01/01/2022

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts...

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).

CVE-2021-44228 Crítica · 10.0 KEV Urgente · 100 Exploit público Ransomware CWE-20 10/12/2021

Apache Log4j2 Remote Code Execution Vulnerability

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

CVE-2021-43797 Média · 6.5 CWE-444 09/12/2021

HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

CVE-2021-43975 Média · 6.7 CWE-787 17/11/2021

Out-of-bounds Write em Linux Linux Kernel

In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value.

CVE-2021-43618 Alta · 7.5 CWE-190 15/11/2021

GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer...

GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.

CVE-2021-37137 Alta · 7.5 CWE-400 19/10/2021

Uncontrolled Resource Consumption em Netty

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

CVE-2021-37136 Alta · 7.5 CWE-400 19/10/2021

Uncontrolled Resource Consumption em Netty

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

CVE-2021-42013 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-22 07/10/2021

Apache HTTP Server Path Traversal Vulnerability

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

CVE-2021-41773 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-22 05/10/2021

Apache HTTP Server Path Traversal Vulnerability

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

CVE-2021-22947 Média · 5.9 CWE-345 29/09/2021

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using...

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

CVE-2021-22946 Alta · 7.5 CWE-319 29/09/2021

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking...

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

CVE-2021-41617 Alta · 7.0 26/09/2021

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used,...

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

CVE-2021-22945 Crítica · 9.1 CWE-415 23/09/2021

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances...

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.

CVE-2021-41079 Alta · 7.5 CWE-835 16/09/2021

Apache Tomcat DoS with unexpected TLS packet

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

CVE-2021-40438 Crítica · 9.0 KEV Urgente · 83 Exploit público Ransomware CWE-918 16/09/2021

Apache HTTP Server-Side Request Forgery (SSRF)

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVE-2021-3711 Crítica · 9.8 CWE-120 24/08/2021

Estouro de buffer na decriptação SM2 do OpenSSL

Para decriptar dados cifrados com SM2, uma aplicação deve chamar a função de API EVP_PKEY_decrypt(). Normalmente, uma aplicação chama essa função duas vezes. Na primeira vez, na entrada, o parâmetro "out" pode ser NULL e, na saída, o parâmetro "outlen" é preenchido com o tamanho do buffer necessário para armazenar o texto simples decriptado. A aplicação pode então alocar um buffer de tamanho suficiente e chamar EVP_PKEY_decrypt() novamente, mas desta vez passando um valor não NULL para o parâmetro "out". Um erro na implementação do código de decriptação SM2 faz com que o cálculo do tamanho do buffer necessário para armazenar o texto simples retornado pela primeira chamada a EVP_PKEY_decrypt() possa ser menor do que o tamanho real exigido pela segunda chamada. Isso pode levar a um estouro de buffer quando EVP_PKEY_decrypt() é chamada pela aplicação uma segunda vez com um buffer pequeno demais. Um atacante malicioso capaz de apresentar conteúdo SM2 para decriptação a uma aplicação poderia fazer com que dados escolhidos pelo atacante estourem o buffer em até no máximo 62 bytes, alterando o conteúdo de outros dados armazenados após o buffer, possivelmente mudando o comportamento da aplicação ou causando travamento. A localização do buffer depende da aplicação, mas normalmente é alocada na heap. Corrigido no OpenSSL 1.1.1l (afetadas 1.1.1-1.1.1k).

CVE-2021-39152 Alta · 8.5 Exploit público CWE-502 23/08/2021

A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.

CVE-2021-39150 Alta · 8.5 CWE-502 23/08/2021

A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling

CVE-2021-39140 Média · 6.3 CWE-502 23/08/2021

XStream can cause a Denial of Service

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

CVE-2021-39154 Alta · 8.5 CWE-434 23/08/2021

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

CVE-2021-39153 Alta · 8.5 CWE-434 23/08/2021

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.