Netapp a220 Firmware vulnerabilities

9 CVEs affecting Netapp a220 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-6387, published 2024-07-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-2215: Android Kernel Use-After-Free Vulnerability, published 2019-10-11. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 72.1% chance of exploitation in the next 30 days. A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require…
CVE-2024-6387, published 2024-07-01. High severity, CVSS 8.1. EPSS: 99.5% chance of exploitation in the next 30 days. A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote…
CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
CVE-2020-8835, published 2020-04-02. High severity, CVSS 7.8. EPSS: 6% chance of exploitation in the next 30 days. In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel…
CVE-2019-14816, published 2019-09-20. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash)…
CVE-2019-14814, published 2019-09-20. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system…
CVE-2024-26641, published 2024-03-18. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() syzbot found __ip6_tnl_rcv() could access unitiliazed data…
CVE-2024-26633, published 2024-03-18. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is…
CVE-2024-26733, published 2024-04-03. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arp_req_get(). syzkaller reported an overflown write in arp_req_get(). [0] When ioctl(SIOCGARP) is…