Zfs Storage Appliance Kit (Oracle) - vulnerabilities (CVEs)

120 CVEs, 2 in the last 30 days, 1 known versions, newest CVE from 2026-10-20. Vendor: Oracle.

CVEs of Zfs Storage Appliance Kit

CVE-2026-91527 - CVSS 8.8 (high), 2026-10-20: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily…
CVE-2026-101597 - CVSS 5.3 (medium), 2026-10-20: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily…
CVE-2026-21930 - CVSS 2.3 (low), 2026-01-20: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). The supported version that is affected is 8.8.…
CVE-2025-62475 - CVSS 4.9 (medium), 2025-10-21: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily…
CVE-2025-62478 - CVSS 4.9 (medium), 2025-10-21: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store). The supported version that is affected is 8.8.…
CVE-2025-62290 - CVSS 7.2 (high), 2025-10-21: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The supported version that is affected is 8.8.…
CVE-2025-62477 - CVSS 4.9 (medium), 2025-10-21: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remote Replication). The supported version that is affected is…
CVE-2025-62480 - CVSS 2.7 (low), 2025-10-21: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Naming Subsystem). The supported version that is affected is 8.8.…
CVE-2025-62476 - CVSS 4.9 (medium), 2025-10-21: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remote Replication). The supported version that is affected is…
CVE-2025-62479 - CVSS 2.7 (low), 2025-10-21: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The supported version that is affected is 8.8.…
CVE-2025-62289 - CVSS 4.9 (medium), 2025-10-21: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). The supported version that is affected is 8.8.…
CVE-2025-53046 - CVSS 4.9 (medium), 2025-10-21: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Analytics). The supported version that is affected is 8.8. Easily…
CVE-2024-21155 - CVSS 4.7 (medium), 2024-07-16: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: User Interface). The supported version that is affected is 8.8.…
CVE-2024-21104 - CVSS 6.5 (medium), 2024-04-16: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily…
CVE-2023-21833 - CVSS 4.3 (medium), 2024-02-17: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store). The supported version that is affected is 8.8.…
CVE-2024-20959 - CVSS 4.4 (medium), 2024-01-16: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily…
CVE-2024-20914 - CVSS 2.3 (low), 2024-01-16: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily…
CVE-2022-21563 - CVSS 3.4 (low), 2022-07-19: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily…
CVE-2022-21513 - CVSS 8.2 (high), 2022-07-19: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily…
CVE-2022-29824 - CVSS 6.5 (medium), 2022-05-03: In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in…
CVE-2022-24801 - CVSS 8.1 (high), 2022-04-04: Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in…
CVE-2022-22719 - CVSS 7.5 (high), 2022-03-14: A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52…
CVE-2022-23943 - CVSS 9.8 (critical), 2022-03-14: Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This…
CVE-2022-22721 - CVSS 9.1 (critical), 2022-03-14: If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out…
CVE-2022-22720 - CVSS 9.8 (critical), 2022-03-14: Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP…
CVE-2022-21716 - CVSS 7.5 (high), 2022-03-03: Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to…
CVE-2022-23308 - CVSS 7.5 (high), 2022-02-26: valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
CVE-2021-4115 - CVSS 5.5 (medium), 2022-02-21: There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from…
CVE-2022-25315 - CVSS 9.8 (critical), 2022-02-18: In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
CVE-2022-25314 - CVSS 7.5 (high), 2022-02-18: In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
CVE-2022-25313 - CVSS 6.5 (medium), 2022-02-18: In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.
CVE-2022-25236 - CVSS 9.8 (critical), 2022-02-16: xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
CVE-2022-25235 - CVSS 9.8 (critical), 2022-02-16: xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain…
CVE-2022-0391 - CVSS 7.5 (high), 2022-02-09: A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The…
CVE-2021-4034 - CVSS 7.8 (high), 2022-01-28: A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users…
CVE-2022-21375 - CVSS 5.5 (medium), 2022-01-19: Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable…
CVE-2022-21271 - CVSS 5.3 (medium), 2022-01-19: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected…
CVE-2021-4182 - CVSS 7.5 (high), 2021-12-30: Crash in the RFC 7468 dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
CVE-2021-4185 - CVSS 7.5 (high), 2021-12-30: Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
CVE-2021-4181 - CVSS 7.5 (high), 2021-12-30: Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
CVE-2021-4184 - CVSS 7.5 (high), 2021-12-30: Infinite loop in the BitTorrent DHT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
CVE-2021-4183 - CVSS 5.5 (medium), 2021-12-30: Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture file
CVE-2021-44790 - CVSS 9.8 (critical), 2021-12-20: A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is…
CVE-2021-43818 - CVSS 8.2 (high), 2021-12-13: lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script…
CVE-2021-42717 - CVSS 7.5 (high), 2021-12-07: ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web…
CVE-2021-25219 - CVSS 5.3 (medium), 2021-10-27: In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as…
CVE-2021-41617 - CVSS 7 (high), 2021-09-26: sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not…
CVE-2021-34798 - CVSS 7.5 (high), 2021-09-16: Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-40438 - CVSS 9 (critical), 2021-09-16: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server…
CVE-2021-39275 - CVSS 9.8 (critical), 2021-09-16: ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but…
CVE-2021-36160 - CVSS 7.5 (high), 2021-09-16: A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server…
CVE-2021-3712 - CVSS 7.4 (high), 2021-08-24: ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the…
CVE-2021-3711 - CVSS 9.8 (critical), 2021-08-24: In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this…
CVE-2021-36690 - CVSS 7.5 (high), 2021-08-24: A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query.…
CVE-2021-33193 - CVSS 7.5 (high), 2021-08-16: A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue…
CVE-2021-3541 - CVSS 6.5 (medium), 2021-07-09: A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
CVE-2021-33503 - CVSS 7.5 (high), 2021-06-29: An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular…
CVE-2021-31618 - CVSS 7.5 (high), 2021-06-15: Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used…
CVE-2021-26691 - CVSS 9.8 (critical), 2021-06-10: In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow
CVE-2019-17567 - CVSS 5.3 (medium), 2021-06-10: Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the…
CVE-2021-26690 - CVSS 7.5 (high), 2021-06-10: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading…
CVE-2020-35452 - CVSS 7.3 (high), 2021-06-10: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this…
CVE-2021-30641 - CVSS 5.3 (medium), 2021-06-10: Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'
CVE-2020-13950 - CVSS 7.5 (high), 2021-06-10: Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both…
CVE-2021-22222 - CVSS 7.5 (high), 2021-06-07: Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet injection or crafted capture file
CVE-2021-3520 - CVSS 9.8 (critical), 2021-06-02: There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling…
CVE-2021-3516 - CVSS 7.8 (high), 2021-06-01: There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a…
CVE-2021-3426 - CVSS 5.7 (medium), 2021-05-20: There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server…
CVE-2021-3517 - CVSS 8.6 (high), 2021-05-19: There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be…
CVE-2021-29921 - CVSS 9.8 (critical), 2021-05-06: In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows…
CVE-2021-22207 - CVSS 6.5 (medium), 2021-04-23: Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injection or crafted…
CVE-2021-3449 - CVSS 5.9 (medium), 2021-03-25: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits…
CVE-2021-20227 - CVSS 5.5 (medium), 2021-03-23: A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the…
CVE-2021-28957 - CVSS 6.1 (medium), 2021-03-21: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner…
CVE-2021-23839 - CVSS 3.7 (low), 2021-02-16: OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS…
CVE-2021-23841 - CVSS 5.9 (medium), 2021-02-16: The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained…
CVE-2021-3177 - CVSS 9.8 (critical), 2021-01-19: Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications…
CVE-2020-26422 - CVSS 5.3 (medium), 2020-12-21: Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file
CVE-2020-26420 - CVSS 5.3 (medium), 2020-12-11: Memory leak in RTPS protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file.
CVE-2020-26419 - CVSS 5.3 (medium), 2020-12-11: Memory leak in the dissection engine in Wireshark 3.4.0 allows denial of service via packet injection or crafted capture file.
CVE-2020-26418 - CVSS 5.3 (medium), 2020-12-11: Memory leak in Kafka protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file.
CVE-2020-26421 - CVSS 5.3 (medium), 2020-12-11: Crash in USB HID protocol dissector and possibly other dissectors in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or…
CVE-2020-29651 - CVSS 7.5 (high), 2020-12-09: A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a…
CVE-2020-27783 - CVSS 6.1 (medium), 2020-12-03: A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors…
CVE-2020-25866 - CVSS 7.5 (high), 2020-10-06: In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13, the BLIP protocol dissector has a NULL pointer dereference because a buffer was sized for compressed (not…
CVE-2020-26137 - CVSS 6.5 (medium), 2020-09-30: urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the…
CVE-2020-26116 - CVSS 7.2 (high), 2020-09-27: http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the…
CVE-2020-24583 - CVSS 7.5 (high), 2020-09-01: An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS…
CVE-2020-24584 - CVSS 7.5 (high), 2020-09-01: An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of…
CVE-2020-1472 - CVSS 10 (critical), 2020-08-17: An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the…
CVE-2020-17498 - CVSS 6.5 (medium), 2020-08-13: In Wireshark 3.2.0 to 3.2.5, the Kafka protocol dissector could crash. This was addressed in epan/dissectors/packet-kafka.c by avoiding a double free during…
CVE-2020-9490 - CVSS 7.5 (high), 2020-08-07: Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the…
CVE-2020-11993 - CVSS 7.5 (high), 2020-08-07: Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were…
CVE-2020-11984 - CVSS 9.8 (critical), 2020-08-07: Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
CVE-2019-20907 - CVSS 7.5 (high), 2020-07-13: In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because…
CVE-2019-20892 - CVSS 6.5 (medium), 2020-06-25: net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp…
CVE-2020-15025 - CVSS 4.9 (medium), 2020-06-24: ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets,…
CVE-2020-13871 - CVSS 7.5 (high), 2020-06-06: SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
CVE-2020-13596 - CVSS 6.1 (medium), 2020-06-03: An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not…
CVE-2020-13254 - CVSS 5.9 (medium), 2020-06-03: An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing…