NetApp
Page 25 of 26 — NetApp CVEs from a corpus of 2516, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12859 | Medium | 5.9 | 2017-08-18 | NetApp Data ONTAP before 8.2.5, when operating in 7-Mode in NFS environments, allows remote attackers to cause a denial of service via unspecified vectors. |
CVE-2016-6796 | High | 7.5 | 2017-08-11 | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to… |
CVE-2016-6797 | High | 7.5 | 2017-08-10 | The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not… |
CVE-2016-6794 | Medium | 5.3 | 2017-08-10 | When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0… |
CVE-2016-5018 | Critical | 9.1 | 2017-08-10 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass… |
CVE-2016-0762 | Medium | 5.9 | 2017-08-10 | The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not proc… |
CVE-2017-10243 | Medium | 6.5 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAX-WS). Supported versions that are affected are Java SE: 6… |
CVE-2017-10198 | Medium | 6.8 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE… |
CVE-2017-10193 | Low | 3.1 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7… |
CVE-2017-10176 | High | 7.5 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE… |
CVE-2017-10135 | Medium | 5.9 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u15… |
CVE-2017-10125 | High | 7.1 | 2017-08-08 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 7u141 and 8u131. Difficu… |
CVE-2017-10118 | High | 7.5 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u14… |
CVE-2017-10116 | High | 8.3 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE… |
CVE-2017-10115 | High | 7.5 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u15… |
CVE-2017-10114 | High | 8.3 | 2017-08-08 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u141 and 8u131. Difficult t… |
CVE-2017-10111 | Critical | 9.6 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). The supported version that is affected is Java SE: 8u131… |
CVE-2017-10110 | Critical | 9.6 | 2017-08-08 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Easily… |
CVE-2017-10109 | Medium | 5.3 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Jav… |
CVE-2017-10108 | Medium | 5.3 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Jav… |
CVE-2017-10107 | Critical | 9.6 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u151, 7u141… |
CVE-2017-10105 | Medium | 4.3 | 2017-08-08 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131… |
CVE-2017-10102 | Critical | 9.0 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u151, 7u141… |
CVE-2017-10101 | Critical | 9.6 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u151, 7u141… |
CVE-2017-10096 | Critical | 9.6 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u151, 7u141… |
CVE-2017-10090 | Critical | 9.6 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u141 a… |
CVE-2017-10089 | Critical | 9.6 | 2017-08-08 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: ImageIO). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Eas… |
CVE-2017-10087 | Critical | 9.6 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u151… |
CVE-2017-10086 | Critical | 9.6 | 2017-08-08 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u141 and 8u131. Easily expl… |
CVE-2017-10081 | Medium | 4.3 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u151, 7u… |
CVE-2017-10078 | High | 8.1 | 2017-08-08 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting). The supported version that is affected is Java SE: 8u131. Easily exploitabl… |
CVE-2017-10074 | High | 8.3 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot). Supported versions that are affected are Java SE: 6u151, 7u… |
CVE-2017-10067 | High | 7.5 | 2017-08-08 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Di… |
CVE-2017-10053 | Medium | 5.3 | 2017-08-08 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 6u151… |
CVE-2015-7871 | Critical | 9.8 | 2017-08-07 | Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication. |
CVE-2015-7855 | Medium | 6.5 | 2017-08-07 | The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure)… |
CVE-2015-7854 | High | 8.8 | 2017-08-07 | Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a deni… |
CVE-2015-7853 | Critical | 9.8 | 2017-08-07 | The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a… |
CVE-2015-7852 | Medium | 5.9 | 2017-08-07 | ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets. |
CVE-2015-7850 | Medium | 6.5 | 2017-08-07 | ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing t… |
CVE-2015-7849 | High | 8.8 | 2017-08-07 | Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code… |
CVE-2015-7705 | Critical | 9.8 | 2017-08-07 | The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted re… |
CVE-2015-7704 | High | 7.5 | 2017-08-07 | The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages. |
CVE-2015-7702 | Medium | 6.5 | 2017-08-07 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This… |
CVE-2015-7701 | High | 7.5 | 2017-08-07 | Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (mem… |
CVE-2015-7692 | High | 7.5 | 2017-08-07 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This… |
CVE-2015-7691 | High | 7.5 | 2017-08-07 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted… |
CVE-2015-7887 | High | 8.1 | 2017-08-07 | NetApp SnapCenter Server 1.0 allows remote authenticated users to list and delete backups. |
CVE-2016-8743 | High | 7.5 | 2017-07-27 | Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Ac… |
CVE-2017-8919 | Medium | 6.5 | 2017-07-25 | NetApp OnCommand API Services before 1.2P3 logs the LDAP BIND password when a user attempts to log in using the REST API, which allows remote authenticated use… |
CVE-2015-7703 | High | 7.5 | 2017-07-24 | The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allow… |
CVE-2017-7947 | Medium | 6.5 | 2017-07-17 | NetApp Clustered Data ONTAP before 8.3.2P11, 9.0 before P4, and 9.1 before P5 allow attackers to obtain sensitive password information by leveraging logging of… |
CVE-2017-9788 | Critical | 9.1 | 2017-07-13 | In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset bef… |
CVE-2017-11147 | Critical | 9.1 | 2017-07-10 | In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter… |
CVE-2016-5045 | High | 8.1 | 2017-07-03 | NetApp OnCommand System Manager before 9.0 allows remote attackers to obtain sensitive credentials via vectors related to cluster peering setup. |
CVE-2016-3998 | High | 8.1 | 2017-07-03 | NetApp AltaVault 4.1 and earlier allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service via vectors… |
CVE-2016-3997 | High | 7.5 | 2017-07-03 | NetApp Clustered Data ONTAP allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service by leveraging fai… |
CVE-2016-3400 | High | 7.5 | 2017-07-03 | NetApp Data ONTAP 8.1 and 8.2, when operating in 7-Mode, allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial… |
CVE-2017-7668 | High | 7.5 | 2017-06-20 | The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the… |
CVE-2017-3167 | Critical | 9.8 | 2017-06-20 | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may l… |
CVE-2017-7439 | High | 7.5 | 2017-05-26 | NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors involving error messa… |
CVE-2017-7236 | High | 7.5 | 2017-05-26 | SQL injection vulnerability in NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 allows remote attackers to execute arbitrary SQL commands via u… |
CVE-2016-9843 | Critical | 9.8 | 2017-05-23 | The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calcula… |
CVE-2016-9841 | Critical | 9.8 | 2017-05-23 | inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. |
CVE-2017-9119 | Critical | 9.8 | 2017-05-21 | The i_zval_ptr_dtor function in Zend/zend_variables.h in PHP 7.1.5 allows attackers to cause a denial of service (memory consumption and application crash) or… |
CVE-2017-9078 | High | 8.8 | 2017-05-19 | The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the… |
CVE-2017-5645 | Critical | 9.8 | 2017-04-17 | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially… |
CVE-2017-7345 | Medium | 5.3 | 2017-04-10 | NetApp OnCommand Performance Manager and OnCommand Unified Manager for Clustered Data ONTAP before 7.1P1 improperly bind the Java Management Extension Remote M… |
CVE-2017-5988 | High | 7.5 | 2017-04-10 | NetApp Clustered Data ONTAP 8.1 through 9.1P1, when NFS or SMB is enabled, allows remote attackers to cause a denial of service via unspecified vectors. |
CVE-2016-8735 | Critical | 9.8 | 2017-04-06 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRe… |
CVE-2016-7103 | Medium | 6.1 | 2017-03-15 | Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText param… |
CVE-2016-8747 | High | 7.5 | 2017-03-14 | An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.ja… |
CVE-2017-5638 | Critical | 9.8 | 2017-03-11 | The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation dur… |
CVE-2017-5995 | High | 7.5 | 2017-03-01 | The NetApp ONTAP Select Deploy administration utility 2.0 through 2.2.1 might allow remote attackers to obtain sensitive information via unspecified vectors. |
CVE-2016-5374 | High | 8.8 | 2017-03-01 | NetApp Data ONTAP 9.0 and 9.1 before 9.1P1 allows remote authenticated users that own SMB-hosted data to bypass intended sharing restrictions by leveraging imp… |
CVE-2016-6667 | Critical | 9.8 | 2017-02-07 | NetApp OnCommand Unified Manager for Clustered Data ONTAP 6.3 through 6.4P1 contain a default privileged account, which allows remote attackers to execute arbi… |
CVE-2016-6495 | Medium | 5.9 | 2017-02-07 | NetApp Data ONTAP before 8.2.4P5, when operating in 7-Mode, allows remote attackers to obtain information about the volumes configured for HTTP access. |
CVE-2016-5711 | Critical | 9.8 | 2017-02-07 | NetApp Virtual Storage Console for VMware vSphere before 6.2.1 uses a non-unique certificate, which allows remote attackers to conduct man-in-the-middle attack… |
CVE-2016-5372 | Medium | 6.3 | 2017-02-07 | Cross-site request forgery (CSRF) vulnerability in NetApp Snap Creator Framework before 4.3.0P1 allows remote attackers to hijack the authentication of users f… |
CVE-2016-4341 | High | 7.5 | 2017-02-07 | NetApp Clustered Data ONTAP before 8.3.2P7 allows remote attackers to obtain SMB share information via unspecified vectors. |
CVE-2016-3063 | High | 7.5 | 2017-02-07 | Multiple functions in NetApp OnCommand System Manager before 8.3.2 do not properly escape special characters, which allows remote authenticated users to execut… |
CVE-2016-1894 | High | 8.1 | 2017-02-07 | NetApp OnCommand Workflow Automation before 3.1P2 allows remote attackers to bypass authentication via unspecified vectors. |
CVE-2016-1502 | High | 7.3 | 2017-02-07 | NetApp SnapCenter Server 1.0 and 1.0P1 allows remote attackers to partially bypass authentication and then list and delete backups via unspecified vectors. |
CVE-2015-8544 | High | 7.5 | 2017-02-07 | NetApp SnapDrive for Windows before 7.0.2P4, 7.0.3, and 7.1 before 7.1.3P1 allows remote attackers to obtain sensitive information via unspecified vectors. |
CVE-2015-8322 | High | 8.8 | 2017-02-07 | NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbitrary code via unspecified vectors. |
CVE-2016-10165 | High | 7.1 | 2017-02-03 | The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an… |
CVE-2017-5600 | Critical | 9.8 | 2017-02-02 | The Data Warehouse component in NetApp OnCommand Insight before 7.2.3 allows remote attackers to obtain administrative access by leveraging a default privilege… |
CVE-2016-2518 | Medium | 5.3 | 2017-01-30 | The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer reque… |
CVE-2015-7977 | Medium | 5.9 | 2017-01-30 | ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command. |
CVE-2015-7973 | Medium | 6.5 | 2017-01-30 | NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the net… |
CVE-2016-10160 | Critical | 9.8 | 2017-01-24 | Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial… |
CVE-2016-9131 | High | 7.5 | 2017-01-12 | named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion fai… |
CVE-2016-6820 | High | 7.5 | 2017-01-11 | MetroCluster Tiebreaker for clustered Data ONTAP in versions before 1.2 discloses sensitive information in cleartext which may be viewed by an unauthenticated… |
CVE-2015-8020 | Low | 3.7 | 2017-01-11 | Clustered Data ONTAP versions 8.0, 8.3.1, and 8.3.2 contain a default privileged account which under certain conditions can be used for unauthorized informatio… |
CVE-2016-7480 | Critical | 9.8 | 2017-01-11 | The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote att… |
CVE-2017-5340 | Critical | 9.8 | 2017-01-11 | Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to ex… |
CVE-2015-7848 | High | 7.5 | 2017-01-06 | An integer overflow can occur in NTP-dev.4.3.70 leading to an out-of-bounds memory copy operation when processing a specially crafted private mode packet. The… |
CVE-2016-7172 | High | 7.5 | 2016-12-21 | NetApp Snap Creator Framework before 4.3.1 discloses sensitive information which could be viewed by an unauthorized user. |
CVE-2016-7171 | Medium | 5.6 | 2016-12-05 | NetApp Plug-in for Symantec NetBackup prior to version 2.0.1 makes use of a non-unique server certificate, making it vulnerable to impersonation. |
CVE-2016-5195 | High | 7.0 | 2016-11-10 | Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on… |