Netapp Ontap Tools vulnerabilities

• apache httpclient, apache software foundation httpcomponents, netapp ontap tools +2 more Apache HttpComponents: PSL (Public Suffix List) validation bypass CVE-2025-27820 Fix available 7.5 HighApril 24, 2025
• curl, netapp bootstrap os, element software +32 more +34 more netrc and default credential leak CVE-2025-0167 Fix available 3.4 LowFebruary 5, 2025
• gnome glib, debian linux, netapp active iq unified manager +31 more +33 more gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer... CVE-2024-52533 Fix available 9.8 CriticalNovember 11, 2024
• ruby rexml, netapp ontap tools +1 more REXML ReDoS vulnerability CVE-2024-49761 Fix available 6.6 MediumOctober 28, 2024
• apache commons io, netapp active iq unified manager, bluexp +5 more +7 more Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader CVE-2024-47554 Fix available 4.3 MediumOctober 3, 2024
• google protobuf, protocol buffers, google-protobuf [jruby gem] +8 more +10 more Stack overflow in Protocol Buffers Java Lite CVE-2024-7254 Fix available 8.7 HighSeptember 19, 2024
• curl, debian linux, netapp active iq unified manager +26 more +28 more OCSP stapling bypass with GnuTLS CVE-2024-8096 Fix available 6.5 MediumSeptember 11, 2024
• netapp 500f firmware, a250 firmware, active iq unified manager +22 more +24 more Possible denial of service in X.509 name checks CVE-2024-6119 Fix available EPSS 66.6% 7.5 HighSeptember 3, 2024
• apache tomcat, netapp ontap tools +1 more Apache Tomcat: Denial of Service CVE-2024-38286 Fix available 8.6 HighAugust 21, 2024
• certifi, certifi python-certifi, netapp management services for element software and netapp hci +2 more +4 more Certifi removes GLOBALTRUST root certificate CVE-2024-39689 Public exploitFix available 7.5 HighJuly 5, 2024
• apache http server, netapp ontap tools +1 more Apache HTTP Server: source code disclosure with handlers configured via AddType CVE-2024-39884 Fix available 6.2 MediumJuly 4, 2024
• apache tomcat, netapp ontap tools +1 more Apache Tomcat: HTTP/2 excess header handling DoS CVE-2024-34750 Fix available 7.5 HighJuly 3, 2024
• openbsd openssh, almalinux, amazon linux +71 more +73 more Openssh: regresshion - race condition in ssh allows rce/dos CVE-2024-6387 Public exploitFix available EPSS 99.5% 8.1 HighJuly 1, 2024
• bouncycastle bouncy castle for java, netapp active iq unified manager, bluexp +2 more +4 more Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack") CVE-2024-30171 Fix available 5.9 MediumMay 7, 2024
• gnome glib, debian linux, fedoraproject fedora +7 more +9 more An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a... CVE-2024-34397 Fix available 5.2 MediumMay 7, 2024
• apache http server, apple macos, broadcom fabric operating system +4 more +6 more Apache HTTP Server: HTTP Response Splitting in multiple modules CVE-2024-24795 Fix available 6.3 MediumApril 4, 2024
• apache http server, apple macos, broadcom fabric operating system +4 more +6 more Apache HTTP Server: HTTP response splitting CVE-2023-38709 Public exploitFix available 7.3 HighApril 4, 2024
• apache commons configuration, fedoraproject fedora, netapp ontap tools +1 more +3 more Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator() CVE-2024-29131 Fix available 7.3 HighMarch 21, 2024
• debian linux, linux kernel, netapp 9500 firmware +17 more +19 more ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() CVE-2024-26633 Fix available 5.5 MediumMarch 18, 2024
• apache cxf, netapp oncommand workflow automation, ontap tools +2 more Apache CXF SSRF Vulnerability using the Aegis databinding CVE-2024-28752 Public exploitFix available 9.3 CriticalMarch 15, 2024
• libexpat project libexpat, fedoraproject fedora, netapp active iq unified manager +15 more +17 more libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of... CVE-2024-28757 Public exploitFix available 7.5 HighMarch 10, 2024
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more +4 more MongoDB Server may allow successful untrusted connection CVE-2024-1351 Fix available 8.8 HighMarch 7, 2024
• linux, linux kernel, netapp ontap tools +2 more netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction CVE-2023-52433 Fix available 7.8 HighFebruary 20, 2024
• linux kernel, netapp ontap tools, red hat enterprise linux 6 +8 more +10 more Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive_encrypted_standard of client CVE-2024-0565 Fix available 6.8 MediumJanuary 15, 2024
• mit kerberos 5, debian linux, netapp active iq unified manager +4 more +6 more lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1... CVE-2023-36054 Fix available 6.5 MediumAugust 7, 2023
• openldap, apple macos, netapp active iq unified manager +11 more +13 more A vulnerability was found in openldap. This security flaw causes a null pointer dereference in... CVE-2023-2953 Fix available 7.5 HighMay 30, 2023
• apache log4j, log4j2, apple xcode +141 more +143 more Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints CVE-2021-44228 In KEVPublic exploitFix available EPSS 100.0% 10.0 CriticalDecember 10, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, jenkins +19 more +21 more Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources CVE-2021-28165 Public exploitFix available EPSS 53.9% 7.5 HighApril 1, 2021
• sudo, beyondtrust privilege management for mac, privilege management for unix\/linux +21 more +23 more Sudo before 1.9.5p2 has a Heap-based Buffer Overflow, allowing privilege escalation to root via ... CVE-2021-3156 In KEVPublic exploitFix available EPSS 100.0% 7.8 HighJanuary 26, 2021
• ntp, fujitsu m10-1 firmware, m10-4 firmware +22 more +24 more ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of... CVE-2020-13817 Fix available 5.9 MediumJune 4, 2020