Netapp Aff a700s Firmware vulnerabilities

18 CVEs affecting Netapp Aff a700s Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-33060, published 2022-08-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-13272: Linux Kernel Improper Privilege Management Vulnerability, published 2019-07-17. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 52.2% chance of exploitation in the next 30 days. In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to…
CVE-2021-20322, published 2022-02-18. High severity, CVSS 7.4. EPSS: 6.9% chance of exploitation in the next 30 days. A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw…
CVE-2019-19050, published 2019-11-18. High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days. A memory leak in the crypto_reportstat() function in crypto/crypto_user_stat.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering…
CVE-2019-12615, published 2019-06-03. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. An issue was discovered in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup_const of node_info->vdev_port.name, which might allow…
CVE-2019-15538, published 2019-08-25. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota.…
CVE-2019-16995, published 2019-09-30. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. In the Linux kernel before 5.0.3, a memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c if hsr_add_port fails to add a port, which may cause denial of service, aka CID-6caabe7f197d.
CVE-2019-18805, published 2019-11-07. Critical severity, CVSS 9.8. EPSS: 3.5% chance of exploitation in the next 30 days. An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very…
CVE-2019-19069, published 2019-11-18. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. A memory leak in the fastrpc_dma_buf_attach() function in drivers/misc/fastrpc.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering…
CVE-2019-19816, published 2019-12-17. High severity, CVSS 7.8. EPSS: 3.3% chance of exploitation in the next 30 days. In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a…
CVE-2020-14145, published 2020-06-29. Medium severity, CVSS 5.9. EPSS: 2.9% chance of exploitation in the next 30 days. The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial…

Latest

CVE-2021-33060, published 2022-08-18. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2019-25045, published 2021-06-07. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free, related to an xfrm_state_fini panic, aka CID-dbb2483b2a46.
CVE-2020-8832, published 2020-04-10. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors.") was…
CVE-2019-19813, published 2019-12-17. Medium severity, CVSS 5.5. EPSS: 2.1% chance of exploitation in the next 30 days. In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in __mutex_lock in…
CVE-2019-19318, published 2019-11-28. Medium severity, CVSS 4.4. EPSS: 0.6% chance of exploitation in the next 30 days. In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in kernel/locking/rwsem.c) rwsem_owner_flags…