Snap Creator Framework (Netapp) - vulnerabilities (CVEs)

42 CVEs, 0 in the last 30 days, 9 known versions, newest CVE from 2022-04-14. Vendor: Netapp.

CVEs of Snap Creator Framework

CVE-2022-22968 - CVSS 5.3 (medium), 2022-04-14: In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case…
CVE-2020-36518 - CVSS 7.5 (high), 2022-03-11: jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVE-2021-42550 - CVSS 6.6 (medium), 2021-12-16: In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration…
CVE-2021-22096 - CVSS 4.3 (medium), 2021-10-28: In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the…
CVE-2021-34429 - CVSS 5.3 (medium), 2021-07-15: For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the…
CVE-2021-34428 - CVSS 3.5 (low), 2021-06-22: For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID…
CVE-2021-28169 - CVSS 5.3 (medium), 2021-06-09: For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected…
CVE-2020-27223 - CVSS 5.3 (medium), 2021-02-26: In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a…
CVE-2021-23901 - CVSS 9.1 (critical), 2021-01-25: An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity…
CVE-2021-23926 - CVSS 9.1 (critical), 2021-01-14: The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include…
CVE-2020-27218 - CVSS 4.8 (medium), 2020-11-28: In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is…
CVE-2020-13954 - CVSS 6.1 (medium), 2020-11-12: By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected…
CVE-2020-27216 - CVSS 7 (high), 2020-10-23: In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's…
CVE-2020-5421 - CVSS 8.7 (high), 2020-09-19: In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD…
CVE-2020-12723 - CVSS 7.5 (high), 2020-06-05: regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.
CVE-2020-10878 - CVSS 8.6 (high), 2020-06-05: Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to…
CVE-2020-7656 - CVSS 6.1 (medium), 2020-05-19: jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain…
CVE-2020-10683 - CVSS 9.8 (critical), 2020-05-01: dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular…
CVE-2020-11022 - CVSS 6.9 (medium), 2020-04-29: In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods…
CVE-2020-11023 - CVSS 6.9 (medium), 2020-04-29: In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing…
CVE-2016-5710 - CVSS 4.6 (medium), 2020-02-11: NetApp Snap Creator Framework before 4.3P1 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.
CVE-2019-10246 - CVSS 5.3 (medium), 2019-04-22: In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory…
CVE-2019-10247 - CVSS 5.3 (medium), 2019-04-22: In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will…
CVE-2018-18314 - CVSS 9.8 (critical), 2018-12-07: Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.
CVE-2018-18313 - CVSS 9.1 (critical), 2018-12-07: Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.
CVE-2018-18311 - CVSS 9.8 (critical), 2018-12-07: Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.
CVE-2018-18312 - CVSS 9.8 (critical), 2018-12-05: Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.
CVE-2018-11784 - CVSS 4.3 (medium), 2018-10-04: When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g.…
CVE-2018-1000632 - CVSS 7.5 (high), 2018-08-20: dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an…
CVE-2017-7658 - CVSS 9.8 (critical), 2018-06-26: In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two…
CVE-2017-7657 - CVSS 9.8 (critical), 2018-06-26: In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled),…
CVE-2018-12538 - CVSS 8.8 (high), 2018-06-22: In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it…
CVE-2018-12015 - CVSS 7.5 (high), 2018-06-07: In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files,…
CVE-2016-6796 - CVSS 7.5 (high), 2017-08-11: A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able…
CVE-2016-6797 - CVSS 7.5 (high), 2017-08-10: The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not…
CVE-2016-6794 - CVSS 5.3 (medium), 2017-08-10: When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat…
CVE-2016-5018 - CVSS 9.1 (critical), 2017-08-10: In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass…
CVE-2016-0762 - CVSS 5.9 (medium), 2017-08-10: The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not…
CVE-2016-8735 - CVSS 9.8 (critical), 2017-04-06: Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
CVE-2016-5372 - CVSS 6.3 (medium), 2017-02-07: Cross-site request forgery (CSRF) vulnerability in NetApp Snap Creator Framework before 4.3.0P1 allows remote attackers to hijack the authentication of users…
CVE-2016-7172 - CVSS 7.5 (high), 2016-12-21: NetApp Snap Creator Framework before 4.3.1 discloses sensitive information which could be viewed by an unauthorized user.
CVE-2015-8960 - CVSS 8.1 (high), 2016-09-21: The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not…