Ontap Tools (Netapp) - vulnerabilities (CVEs)

30 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2025-04-24. Vendor: Netapp.

CVEs of Ontap Tools

CVE-2025-27820 - CVSS 7.5 (high), 2025-04-24: A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the…
CVE-2025-0167 - CVSS 3.4 (low), 2025-02-05: When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to…
CVE-2024-52533 - CVSS 9.8 (critical), 2024-11-11: gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a…
CVE-2024-38286 - CVSS 8.6 (high), 2024-11-07: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from…
CVE-2024-49761 - CVSS 7.5 (high), 2024-10-28: REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a…
CVE-2024-47554 - CVSS 4.3 (medium), 2024-10-03: Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU…
CVE-2024-7254 - CVSS 8.7 (high), 2024-09-19: Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the…
CVE-2024-8096 - CVSS 6.5 (medium), 2024-09-11: When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it…
CVE-2024-6119 - CVSS 7.5 (high), 2024-09-03: Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address…
CVE-2024-39689 - CVSS 7.5 (high), 2024-07-05: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi…
CVE-2024-39884 - CVSS 6.2 (medium), 2024-07-04: A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar…
CVE-2024-34750 - CVSS 7.5 (high), 2024-07-03: Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did…
CVE-2024-6387 - CVSS 8.1 (high), 2024-07-01: A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an…
CVE-2024-30171 - CVSS 5.9 (medium), 2024-05-14: An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of…
CVE-2024-34397 - CVSS 5.2 (medium), 2024-05-07: An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted…
CVE-2024-24795 - CVSS 6.3 (medium), 2024-04-04: HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to…
CVE-2023-38709 - CVSS 7.3 (high), 2024-04-04: Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache…
CVE-2024-29131 - CVSS 7.3 (high), 2024-03-21: Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are…
CVE-2024-26633 - CVSS 5.5 (medium), 2024-03-18: In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() syzbot pointed…
CVE-2024-28752 - CVSS 9.3 (critical), 2024-03-15: A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on…
CVE-2024-28757 - CVSS 7.5 (high), 2024-03-10: libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
CVE-2024-1351 - CVSS 9.8 (critical), 2024-03-07: Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to…
CVE-2023-52433 - CVSS 7.8 (high), 2024-02-20: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction New elements…
CVE-2024-0565 - CVSS 7.4 (high), 2024-01-15: An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This…
CVE-2023-36054 - CVSS 6.5 (medium), 2023-08-07: lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can…
CVE-2023-2953 - CVSS 7.5 (high), 2023-05-30: A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.
CVE-2021-44228 - CVSS 10 (critical), 2021-12-10: Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and…
CVE-2021-28165 - CVSS 7.5 (high), 2021-04-01: In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVE-2021-3156 - CVSS 7.8 (high), 2021-01-26: Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s"…
CVE-2020-13817 - CVSS 7.4 (high), 2020-06-04: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting…