Netapp Cloud Volumes Ontap Mediator vulnerabilities

10 CVEs affecting Netapp Cloud Volumes Ontap Mediator, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-26462, published 2024-02-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-0778, published 2022-03-15. High severity, CVSS 7.5. EPSS: 73.2% chance of exploitation in the next 30 days. The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates…
CVE-2021-3449, published 2021-03-25. Medium severity, CVSS 5.9. EPSS: 63.5% chance of exploitation in the next 30 days. An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where…
CVE-2021-3450, published 2021-03-25. High severity, CVSS 7.4. EPSS: 18.3% chance of exploitation in the next 30 days. The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to…
CVE-2020-16166, published 2020-07-30. Low severity, CVSS 3.7. EPSS: 5.2% chance of exploitation in the next 30 days. The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is…
CVE-2019-20907, published 2020-07-13. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
CVE-2022-1678, published 2022-05-25. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be used by remote clients.
CVE-2024-26461, published 2024-02-29. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
CVE-2024-26458, published 2024-02-29. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.
CVE-2020-36516, published 2022-02-26. Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP…
CVE-2024-26462, published 2024-02-29. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.