Netapp Cloud Manager vulnerabilities

19 CVEs affecting Netapp Cloud Manager, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-45105, published 2021-12-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2021-31806, published 2021-05-27. Medium severity, CVSS 6.5. EPSS: 95.8% chance of exploitation in the next 30 days. An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range…
CVE-2021-28164, published 2021-04-01. Medium severity, CVSS 5.3. EPSS: 82.4% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF…
CVE-2021-28165, published 2021-04-01. High severity, CVSS 7.5. EPSS: 53.9% chance of exploitation in the next 30 days. In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVE-2021-23337, published 2021-02-15. High severity, CVSS 7.2. EPSS: 21.3% chance of exploitation in the next 30 days. Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2021-31807, published 2021-06-08. Medium severity, CVSS 6.5. EPSS: 15.6% chance of exploitation in the next 30 days. An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server to achieve Denial of Service when delivering responses to HTTP Range requests.…
CVE-2021-28651, published 2021-05-27. High severity, CVSS 7.5. EPSS: 7.5% chance of exploitation in the next 30 days. An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a…
CVE-2020-25097, published 2021-03-19. High severity, CVSS 8.6. EPSS: 7.3% chance of exploitation in the next 30 days. An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise…
CVE-2021-31808, published 2021-05-27. Medium severity, CVSS 6.5. EPSS: 5.3% chance of exploitation in the next 30 days. An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends…

Latest

CVE-2021-42550, published 2021-12-16. Medium severity, CVSS 6.6. EPSS: 4.8% chance of exploitation in the next 30 days. In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from…
CVE-2021-27002, published 2021-10-11. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. NetApp Cloud Manager versions prior to 3.9.10 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to retrieve sensitive data via the web proxy.
CVE-2021-26999, published 2021-08-06. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. NetApp Cloud Manager versions prior to 3.9.9 log sensitive information when an Active Directory connection fails. The logged information is available only to authenticated users. Customers with…
CVE-2021-26998, published 2021-08-06. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. NetApp Cloud Manager versions prior to 3.9.9 log sensitive information that is available only to authenticated users. Customers with auto-upgrade enabled should already be on a fixed version while…