Netapp 500f Firmware vulnerabilities

13 CVEs affecting Netapp 500f Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-6119, published 2024-09-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-1086: Linux Kernel Use-After-Free Vulnerability, published 2024-01-31. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2024-05-30. EPSS: 28.1% chance of exploitation in the next 30 days. A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values…
CVE-2024-6387, published 2024-07-01. High severity, CVSS 8.1. EPSS: 99.5% chance of exploitation in the next 30 days. A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote…
CVE-2023-25136, published 2023-02-03. Medium severity, CVSS 6.5. EPSS: 89.7% chance of exploitation in the next 30 days. OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote…
CVE-2022-0778, published 2022-03-15. High severity, CVSS 7.5. EPSS: 73.2% chance of exploitation in the next 30 days. The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates…
CVE-2024-6119, published 2024-09-03. High severity, CVSS 7.5. EPSS: 66.6% chance of exploitation in the next 30 days. Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the…
CVE-2020-8625, published 2021-02-17. High severity, CVSS 8.1. EPSS: 64.2% chance of exploitation in the next 30 days. BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not…
CVE-2021-4044, published 2021-12-14. High severity, CVSS 7.5. EPSS: 50.1% chance of exploitation in the next 30 days. Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error…
CVE-2021-25215, published 2021-04-29. High severity, CVSS 7.5. EPSS: 11.4% chance of exploitation in the next 30 days. In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of…
CVE-2019-25013, published 2021-01-04. Medium severity, CVSS 5.9. EPSS: 3.6% chance of exploitation in the next 30 days. The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.
CVE-2021-31879, published 2021-04-29. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Latest

CVE-2020-25668, published 2021-05-26. High severity, CVSS 7.0. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op.
CVE-2020-27618, published 2021-02-26. Medium severity, CVSS 5.5. EPSS: 0.9% chance of exploitation in the next 30 days. The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails…