Netapp 8700 Firmware vulnerabilities

16 CVEs affecting Netapp 8700 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-6387, published 2024-07-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-22600: Linux Kernel Privilege Escalation Vulnerability, published 2022-01-26. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2022-04-11. EPSS: 6.6% chance of exploitation in the next 30 days. A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past…
CVE-2024-6387, published 2024-07-01. High severity, CVSS 8.1. EPSS: 99.5% chance of exploitation in the next 30 days. A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote…
CVE-2019-5108, published 2019-12-23. Medium severity, CVSS 6.5. EPSS: 10.1% chance of exploitation in the next 30 days. An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for…
CVE-2020-8835, published 2020-04-02. High severity, CVSS 7.8. EPSS: 6% chance of exploitation in the next 30 days. In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel…
CVE-2020-15025, published 2020-06-24. Medium severity, CVSS 4.9. EPSS: 3.4% chance of exploitation in the next 30 days. ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations…
CVE-2019-18282, published 2020-01-16. Medium severity, CVSS 5.3. EPSS: 2.6% chance of exploitation in the next 30 days. The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet…
CVE-2020-29661, published 2020-12-09. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.
CVE-2019-18683, published 2019-11-04. High severity, CVSS 7.0. EPSS: 1% chance of exploitation in the next 30 days. An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0…
CVE-2022-30594, published 2022-05-12. High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days. The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.
CVE-2019-19965, published 2019-12-25. Medium severity, CVSS 4.7. EPSS: 0.7% chance of exploitation in the next 30 days. In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race…

Latest

CVE-2024-26735, published 2024-04-03. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix possible use-after-free and null-ptr-deref The pernet operations structure for the subsystem must be…
CVE-2024-26733, published 2024-04-03. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arp_req_get(). syzkaller reported an overflown write in arp_req_get(). [0] When ioctl(SIOCGARP) is…
CVE-2023-1077, published 2023-03-27. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition…
CVE-2020-29660, published 2020-12-09. Medium severity, CVSS 4.4. EPSS: 0.5% chance of exploitation in the next 30 days. A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against…