Netapp Cloud Secure Agent vulnerabilities

57 CVEs affecting Netapp Cloud Secure Agent, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-39399, published 2022-10-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2022-34169, published 2022-07-19. High severity, CVSS 7.5. EPSS: 81.8% chance of exploitation in the next 30 days. The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal…
CVE-2019-13990, published 2019-07-26. Critical severity, CVSS 9.8. EPSS: 16.6% chance of exploitation in the next 30 days. initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
CVE-2022-21293, published 2022-01-19. Medium severity, CVSS 5.3. EPSS: 8.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311,…
CVE-2022-21340, published 2022-01-19. Medium severity, CVSS 5.3. EPSS: 7.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311,…
CVE-2022-22968, published 2022-04-14. Medium severity, CVSS 5.3. EPSS: 5.7% chance of exploitation in the next 30 days. In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not…
CVE-2020-2781, published 2020-04-15. Medium severity, CVSS 5.3. EPSS: 4.9% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.…
CVE-2020-14621, published 2020-07-15. Medium severity, CVSS 5.3. EPSS: 4.4% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251.…
CVE-2020-14579, published 2020-07-15. Low severity, CVSS 3.7. EPSS: 4.3% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult…
CVE-2020-14578, published 2020-07-15. Low severity, CVSS 3.7. EPSS: 4.3% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult…

Latest

CVE-2022-39399, published 2022-10-18. Low severity, CVSS 3.7. EPSS: 2.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.16.1, 17.0.4.1,…
CVE-2022-21628, published 2022-10-18. Medium severity, CVSS 5.3. EPSS: 2.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Oracle Java SE: 8u341,…
CVE-2022-21626, published 2022-10-18. Medium severity, CVSS 5.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf,…
CVE-2022-21624, published 2022-10-18. Low severity, CVSS 3.7. EPSS: 2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf,…
CVE-2022-21619, published 2022-10-18. Low severity, CVSS 3.7. EPSS: 3.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf,…
CVE-2022-21618, published 2022-10-18. Medium severity, CVSS 5.3. EPSS: 2.8% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle…
CVE-2022-2764, published 2022-09-01. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations.
CVE-2022-1319, published 2022-08-31. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A…
CVE-2022-1259, published 2022-08-31. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an…
CVE-2021-3859, published 2022-08-26. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.