Oncommand System Manager (Netapp) - vulnerabilities (CVEs)

27 CVEs, 0 in the last 30 days, 18 known versions, newest CVE from 2021-02-08. Vendor: Netapp.

CVEs of Oncommand System Manager

• CVE-2020-8587 - CVSS 5.5 (medium), 2021-02-08: OnCommand System Manager 9.x versions prior to 9.3P20 and 9.4 prior to 9.4P3 are susceptible to a vulnerability that could allow HTTP clients to cache…
• CVE-2020-17527 - CVSS 7.5 (high), 2020-12-03: While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request…
• CVE-2020-27218 - CVSS 4.8 (medium), 2020-11-28: In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is…
• CVE-2020-13935 - CVSS 7.5 (high), 2020-07-14: The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to…
• CVE-2020-13934 - CVSS 7.5 (high), 2020-07-14: An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the…
• CVE-2020-11996 - CVSS 7.5 (high), 2020-06-26: A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU…
• CVE-2020-7656 - CVSS 6.1 (medium), 2020-05-19: jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain…
• CVE-2020-11022 - CVSS 6.9 (medium), 2020-04-29: In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods…
• CVE-2020-11023 - CVSS 6.9 (medium), 2020-04-29: In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing…
• CVE-2019-17276 - CVSS 5.4 (medium), 2020-03-24: OnCommand System Manager versions 9.3 prior to 9.3P18 and 9.4 prior to 9.4P2 are susceptible to a cross site scripting vulnerability that could allow an…
• CVE-2020-1938 - CVSS 9.8 (critical), 2020-02-24: When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having…
• CVE-2019-17569 - CVSS 4.8 (medium), 2020-02-24: The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was…
• CVE-2020-1935 - CVSS 4.8 (medium), 2020-02-24: In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed…
• CVE-2013-3322 - CVSS 7.2 (high), 2020-01-31: NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to inject arbitrary commands in the Halt/Reboot interface.
• CVE-2013-3320 - CVSS 6.1 (medium), 2020-01-29: Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject arbitrary web script or HTML via the…
• CVE-2013-3321 - CVSS 7.5 (high), 2020-01-29: NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to the "diagnostic" page…
• CVE-2019-12418 - CVSS 7 (high), 2019-12-23: When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access…
• CVE-2019-17571 - CVSS 9.8 (critical), 2019-12-20: Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary…
• CVE-2019-10247 - CVSS 5.3 (medium), 2019-04-22: In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will…
• CVE-2019-10246 - CVSS 5.3 (medium), 2019-04-22: In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory…
• CVE-2019-11358 - CVSS 6.1 (medium), 2019-04-20: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an…
• CVE-2017-7658 - CVSS 9.8 (critical), 2018-06-26: In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two…
• CVE-2017-7657 - CVSS 9.8 (critical), 2018-06-26: In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled),…
• CVE-2018-12538 - CVSS 8.8 (high), 2018-06-22: In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it…
• CVE-2016-5045 - CVSS 8.1 (high), 2017-07-03: NetApp OnCommand System Manager before 9.0 allows remote attackers to obtain sensitive credentials via vectors related to cluster peering setup.
• CVE-2016-3063 - CVSS 7.5 (high), 2017-02-07: Multiple functions in NetApp OnCommand System Manager before 8.3.2 do not properly escape special characters, which allows remote authenticated users to…
• CVE-2016-5047 - CVSS 6.5 (medium), 2016-09-01: NetApp OnCommand System Manager 8.3.x before 8.3.2P5 allows remote authenticated users to cause a denial of service via unspecified vectors.