Netapp Bootstrap OS vulnerabilities

57 CVEs affecting Netapp Bootstrap OS, 4 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-30691, published 2025-04-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability, published 2025-03-10. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-04-01. EPSS: 99.9% chance of exploitation in the next 30 days. Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in…
CVE-2023-4911: GNU C Library Buffer Overflow Vulnerability, published 2023-10-03. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-11-21. EPSS: 63.8% chance of exploitation in the next 30 days. A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously…
CVE-2024-1086: Linux Kernel Use-After-Free Vulnerability, published 2024-01-31. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2024-05-30. EPSS: 28.1% chance of exploitation in the next 30 days. A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values…
CVE-2022-0492: Linux Kernel Improper Authentication Vulnerability, published 2022-03-03. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-06-02. EPSS: 5.5% chance of exploitation in the next 30 days. A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1…
CVE-2024-6387, published 2024-07-01. High severity, CVSS 8.1. EPSS: 99.5% chance of exploitation in the next 30 days. A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote…
CVE-2022-2068, published 2022-06-21. High severity, CVSS 7.3. EPSS: 96.4% chance of exploitation in the next 30 days. In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command…
CVE-2023-50868, published 2024-02-14. High severity, CVSS 7.5. EPSS: 73.7% chance of exploitation in the next 30 days. The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via…
CVE-2024-6119, published 2024-09-03. High severity, CVSS 7.5. EPSS: 66.6% chance of exploitation in the next 30 days. Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the…
CVE-2022-32206, published 2022-07-07. Medium severity, CVSS 6.5. EPSS: 36.3% chance of exploitation in the next 30 days. curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable…
CVE-2024-2398, published 2024-03-27. High severity, CVSS 8.6. EPSS: 36.1% chance of exploitation in the next 30 days. When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push.…

Latest

CVE-2025-30691, published 2025-04-15. Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 21.0.6, 24; Oracle GraalVM for JDK: 21.0.6 and 24. Difficult to exploit vulnerability…
CVE-2025-29768, published 2025-03-13. Medium severity, CVSS 4.4. EPSS: 0.4% chance of exploitation in the next 30 days. Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because a user must be made to view such an…
CVE-2025-1215, published 2025-02-12. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory…
CVE-2025-0665, published 2025-02-05. High severity, CVSS 7.0. EPSS: 1.3% chance of exploitation in the next 30 days. libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.
CVE-2025-0167, published 2025-02-05. Low severity, CVSS 3.4. EPSS: 0.7% chance of exploitation in the next 30 days. When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This…
CVE-2025-21502, published 2025-01-21. Medium severity, CVSS 4.8. EPSS: 1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java…
CVE-2025-22134, published 2025-01-13. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try…
CVE-2024-56337, published 2024-12-20. Critical severity, CVSS 9.8. EPSS: 9% chance of exploitation in the next 30 days. Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1…
CVE-2024-54677, published 2024-12-17. Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days. Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through…