Clustered Data Ontap (Netapp) - vulnerabilities (CVEs)

145 CVEs, 0 in the last 30 days, 321 known versions, newest CVE from 2024-07-01. Vendor: Netapp.

CVEs of Clustered Data Ontap

CVE-2024-38477 - CVSS 7.5 (high), 2024-07-01: null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are…
CVE-2024-38476 - CVSS 9.8 (critical), 2024-07-01: Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend…
CVE-2024-38474 - CVSS 9.8 (critical), 2024-07-01: Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the…
CVE-2024-21990 - CVSS 9.8 (critical), 2024-04-17: ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deploy…
CVE-2024-21985 - CVSS 7.6 (high), 2024-01-26: ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user…
CVE-2024-21982 - CVSS 6.5 (medium), 2024-01-12: ONTAP versions 9.4 and higher are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information to…
CVE-2023-27314 - CVSS 7.5 (high), 2023-10-12: ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow a remote…
CVE-2023-36054 - CVSS 6.5 (medium), 2023-08-07: lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can…
CVE-2023-3107 - CVSS 7.5 (high), 2023-08-01: A set of carefully crafted ipv6 packets can trigger an integer overflow in the calculation of a fragment reassembled packet's payload length field. This…
CVE-2023-38403 - CVSS 7.5 (high), 2023-07-17: iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.
CVE-2023-2953 - CVSS 7.5 (high), 2023-05-30: A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.
CVE-2023-28322 - CVSS 5.3 (medium), 2023-05-26: An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback…
CVE-2023-28321 - CVSS 5.9 (medium), 2023-05-26: An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject…
CVE-2023-28320 - CVSS 5.9 (medium), 2023-05-26: A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build…
CVE-2023-28319 - CVSS 7.5 (high), 2023-05-26: A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this…
CVE-2023-27533 - CVSS 9.8 (critical), 2023-03-30: A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted…
CVE-2023-27538 - CVSS 7.7 (high), 2023-03-30: An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH…
CVE-2023-27537 - CVSS 5.9 (medium), 2023-03-30: A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for…
CVE-2023-23914 - CVSS 9.1 (critical), 2023-02-23: A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are…
CVE-2023-23916 - CVSS 6.5 (medium), 2023-02-23: An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that…
CVE-2023-23915 - CVSS 6.5 (medium), 2023-02-23: A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when…
CVE-2022-35260 - CVSS 6.5 (medium), 2022-12-05: curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould…
CVE-2022-32221 - CVSS 9.8 (critical), 2022-12-05: When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the…
CVE-2022-40304 - CVSS 7.8 (high), 2022-11-23: An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic…
CVE-2022-40303 - CVSS 7.5 (high), 2022-11-23: An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer…
CVE-2022-3602 - CVSS 7.5 (high), 2022-11-01: A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain…
CVE-2022-23241 - CVSS 8.1 (high), 2022-10-19: Clustered Data ONTAP versions 9.11.1 through 9.11.1P2 with SnapLock configured FlexGroups are susceptible to a vulnerability which could allow an…
CVE-2022-35252 - CVSS 3.7 (low), 2022-09-23: When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver…
CVE-2022-32205 - CVSS 4.3 (medium), 2022-07-07: A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large…
CVE-2022-32208 - CVSS 5.9 (medium), 2022-07-07: When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle…
CVE-2022-32207 - CVSS 9.8 (critical), 2022-07-07: When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a…
CVE-2022-32206 - CVSS 6.5 (medium), 2022-07-07: curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different…
CVE-2022-28614 - CVSS 5.3 (medium), 2022-06-09: The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input…
CVE-2022-30522 - CVSS 7.5 (high), 2022-06-09: If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make…
CVE-2022-26377 - CVSS 7.5 (high), 2022-06-09: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle…
CVE-2022-29404 - CVSS 7.5 (high), 2022-06-09: In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit…
CVE-2022-31813 - CVSS 9.8 (critical), 2022-06-09: Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism.…
CVE-2022-28615 - CVSS 9.1 (critical), 2022-06-09: Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large…
CVE-2022-30556 - CVSS 7.5 (high), 2022-06-09: Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.
CVE-2022-30115 - CVSS 4.3 (medium), 2022-06-02: Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL.…
CVE-2022-27780 - CVSS 7.5 (high), 2022-06-02: The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe…
CVE-2022-27779 - CVSS 5.3 (medium), 2022-06-02: libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send…
CVE-2022-27781 - CVSS 7.5 (high), 2022-06-02: libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous…
CVE-2022-27776 - CVSS 6.5 (medium), 2022-06-02: A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same…
CVE-2022-27775 - CVSS 7.5 (high), 2022-06-02: An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with…
CVE-2022-27774 - CVSS 5.7 (medium), 2022-06-02: An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract…
CVE-2022-27778 - CVSS 8.1 (high), 2022-06-02: A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.
CVE-2022-22576 - CVSS 8.1 (high), 2022-05-26: An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without…
CVE-2022-1343 - CVSS 5.3 (medium), 2022-05-03: The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the…
CVE-2022-1292 - CVSS 9.8 (critical), 2022-05-03: The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a…
CVE-2022-1473 - CVSS 7.5 (high), 2022-05-03: The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This…
CVE-2022-1434 - CVSS 5.9 (medium), 2022-05-03: The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An…
CVE-2022-29824 - CVSS 6.5 (medium), 2022-05-03: In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in…
CVE-2022-0778 - CVSS 7.5 (high), 2022-03-15: The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this…
CVE-2022-23308 - CVSS 7.5 (high), 2022-02-26: valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
CVE-2021-0127 - CVSS 5.5 (medium), 2022-02-09: Insufficient control flow management in some Intel(R) Processors may allow an authenticated user to potentially enable a denial of service via local access.
CVE-2022-23852 - CVSS 9.8 (critical), 2022-01-24: Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
CVE-2021-46143 - CVSS 8.1 (high), 2022-01-06: In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
CVE-2021-21707 - CVSS 5.3 (medium), 2021-11-29: In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the…
CVE-2021-21703 - CVSS 7.8 (high), 2021-10-25: In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as…
CVE-2021-27001 - CVSS 5.5 (medium), 2021-10-19: Clustered Data ONTAP versions 9.x prior to 9.5P18, 9.6P16, 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow an authenticated…
CVE-2021-27003 - CVSS 4.7 (medium), 2021-10-12: Clustered Data ONTAP versions prior to 9.5P18, 9.6P15, 9.7P14, 9.8P5 and 9.9.1 are missing an X-Frame-Options header which could allow a clickjacking attack.
CVE-2021-21705 - CVSS 5.3 (medium), 2021-10-04: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with…
CVE-2021-21704 - CVSS 5.9 (medium), 2021-10-04: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could…
CVE-2021-22946 - CVSS 7.5 (high), 2021-09-29: A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command…
CVE-2021-22947 - CVSS 5.9 (medium), 2021-09-29: When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and…
CVE-2021-41617 - CVSS 7 (high), 2021-09-26: sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not…
CVE-2021-22945 - CVSS 9.1 (critical), 2021-09-23: When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and…
CVE-2021-34798 - CVSS 7.5 (high), 2021-09-16: Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-40438 - CVSS 9 (critical), 2021-09-16: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server…
CVE-2021-39275 - CVSS 9.8 (critical), 2021-09-16: ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but…
CVE-2021-36160 - CVSS 7.5 (high), 2021-09-16: A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server…
CVE-2016-20012 - CVSS 5.3 (medium), 2021-09-15: OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test…
CVE-2021-3712 - CVSS 7.4 (high), 2021-08-24: ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the…
CVE-2021-3711 - CVSS 9.8 (critical), 2021-08-24: In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this…
CVE-2021-22923 - CVSS 5.3 (medium), 2021-08-05: When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same…
CVE-2021-22926 - CVSS 7.5 (high), 2021-08-05: libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with…
CVE-2021-22922 - CVSS 6.5 (medium), 2021-08-05: When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink…
CVE-2021-22925 - CVSS 5.3 (medium), 2021-08-05: curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs…
CVE-2021-22924 - CVSS 3.7 (low), 2021-08-05: libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic,…
CVE-2021-3541 - CVSS 6.5 (medium), 2021-07-09: A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
CVE-2020-7469 - CVSS 7.5 (high), 2021-06-04: In FreeBSD 12.2-STABLE before r367402, 11.4-STABLE before r368202, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 the handler for…
CVE-2021-26994 - CVSS 6.5 (medium), 2021-06-04: Clustered Data ONTAP versions prior to 9.7P13 and 9.8P3 are susceptible to a vulnerability which could allow single workloads to cause a Denial of Service…
CVE-2021-3516 - CVSS 7.8 (high), 2021-06-01: There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a…
CVE-2021-3517 - CVSS 8.6 (high), 2021-05-19: There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be…
CVE-2021-3518 - CVSS 8.8 (high), 2021-05-18: There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2…
CVE-2021-3537 - CVSS 5.9 (medium), 2021-05-14: A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference.…
CVE-2020-7071 - CVSS 5.3 (medium), 2021-02-15: In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will…
CVE-2021-21702 - CVSS 7.5 (high), 2021-02-15: In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server…
CVE-2020-8590 - CVSS 3.3 (low), 2021-02-08: Clustered Data ONTAP versions prior to 9.1P18 and 9.3P12 are susceptible to a vulnerability which could allow an attacker to discover node names via…
CVE-2020-8578 - CVSS 3.3 (low), 2021-02-08: Clustered Data ONTAP versions prior to 9.3P20 are susceptible to a vulnerability which could allow an attacker to discover node names via AutoSupport bundles…
CVE-2020-8588 - CVSS 3.5 (low), 2021-02-03: Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to discover the…
CVE-2020-8589 - CVSS 3.5 (low), 2021-02-03: Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to discover the names…
CVE-2020-8581 - CVSS 6.5 (medium), 2021-01-19: Clustered Data ONTAP versions prior to 9.3P20 and 9.5 are susceptible to a vulnerability which could allow an authenticated but unauthorized attacker to…
CVE-2020-8286 - CVSS 7.5 (high), 2020-12-14: curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
CVE-2020-8285 - CVSS 7.5 (high), 2020-12-14: curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
CVE-2020-8284 - CVSS 3.7 (low), 2020-12-14: A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way…
CVE-2020-8696 - CVSS 5.5 (medium), 2020-11-12: Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable…
CVE-2020-8698 - CVSS 5.5 (medium), 2020-11-12: Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local…
CVE-2020-0590 - CVSS 7.8 (high), 2020-11-12: Improper input validation in BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via…