Oncommand Api Services (Netapp) - vulnerabilities (CVEs)
19 CVEs, 0 in the last 30 days, 7 known versions, newest CVE from 2021-03-30. Vendor: Netapp.
CVEs of Oncommand Api Services
- CVE-2021-21409 - CVSS 5.9 (medium), 2021-03-30: Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers &…
- CVE-2021-21295 - CVSS 5.9 (medium), 2021-03-09: Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers &…
- CVE-2021-20190 - CVSS 8.1 (high), 2021-01-19: A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from…
- CVE-2020-25649 - CVSS 7.5 (high), 2020-12-03: A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity…
- CVE-2020-10683 - CVSS 9.8 (critical), 2020-05-01: dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular…
- CVE-2020-11612 - CVSS 7.5 (high), 2020-04-07: The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large…
- CVE-2019-14893 - CVSS 9.8 (critical), 2020-03-02: A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious…
- CVE-2020-8840 - CVSS 9.8 (critical), 2020-02-10: FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
- CVE-2019-20330 - CVSS 9.8 (critical), 2020-01-03: FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
- CVE-2019-17359 - CVSS 7.5 (high), 2019-10-08: The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted…
- CVE-2019-17267 - CVSS 9.8 (critical), 2019-10-07: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to…
- CVE-2019-16942 - CVSS 9.8 (critical), 2019-10-01: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a…
- CVE-2019-16943 - CVSS 9.8 (critical), 2019-10-01: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a…
- CVE-2019-16335 - CVSS 9.8 (critical), 2019-09-15: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a…
- CVE-2019-14540 - CVSS 9.8 (critical), 2019-09-15: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
- CVE-2018-14550 - CVSS 8.8 (high), 2019-07-10: An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c…
- CVE-2017-15518 - CVSS 7.8 (high), 2018-02-23: All versions of OnCommand API Services prior to 2.1 and NetApp Service Level Manager prior to 1.0RC4 log a privileged database user account password. All…
- CVE-2017-8919 - CVSS 6.5 (medium), 2017-07-25: NetApp OnCommand API Services before 1.2P3 logs the LDAP BIND password when a user attempts to log in using the REST API, which allows remote authenticated…
- CVE-2017-5645 - CVSS 9.8 (critical), 2017-04-17: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially…
