Netapp a250 Firmware vulnerabilities

21 CVEs affecting Netapp a250 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-6119, published 2024-09-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-1086: Linux Kernel Use-After-Free Vulnerability, published 2024-01-31. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2024-05-30. EPSS: 28.1% chance of exploitation in the next 30 days. A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values…
CVE-2024-6387, published 2024-07-01. High severity, CVSS 8.1. EPSS: 99.5% chance of exploitation in the next 30 days. A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote…
CVE-2023-25136, published 2023-02-03. Medium severity, CVSS 6.5. EPSS: 89.7% chance of exploitation in the next 30 days. OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote…
CVE-2022-1292, published 2022-05-03. High severity, CVSS 7.3. EPSS: 82.6% chance of exploitation in the next 30 days. The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed.…
CVE-2022-0778, published 2022-03-15. High severity, CVSS 7.5. EPSS: 73.2% chance of exploitation in the next 30 days. The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates…
CVE-2024-6119, published 2024-09-03. High severity, CVSS 7.5. EPSS: 66.6% chance of exploitation in the next 30 days. Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the…
CVE-2020-8625, published 2021-02-17. High severity, CVSS 8.1. EPSS: 64.2% chance of exploitation in the next 30 days. BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not…
CVE-2021-4044, published 2021-12-14. High severity, CVSS 7.5. EPSS: 50.1% chance of exploitation in the next 30 days. Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error…
CVE-2021-25215, published 2021-04-29. High severity, CVSS 7.5. EPSS: 11.4% chance of exploitation in the next 30 days. In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of…
CVE-2020-14305, published 2020-12-02. High severity, CVSS 8.1. EPSS: 5.2% chance of exploitation in the next 30 days. An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated…

Latest

CVE-2022-1473, published 2022-05-03. High severity, CVSS 7.5. EPSS: 4.6% chance of exploitation in the next 30 days. The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding…
CVE-2022-1434, published 2022-05-03. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by…
CVE-2022-1343, published 2022-05-03. Medium severity, CVSS 5.3. EPSS: 2.1% chance of exploitation in the next 30 days. The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a…