Netapp Clustered Data Ontap vulnerabilities

188 CVEs affecting Netapp Clustered Data Ontap, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-38477, published 2024-07-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF), published 2021-09-16. Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2021-12-01. EPSS: 100% chance of exploitation in the next 30 days. A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability, published 2015-07-29. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2026-10-08. EPSS: 99.4% chance of exploitation in the next 30 days. named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
CVE-2018-15473, published 2018-08-17. Medium severity, CVSS 5.3. EPSS: 98.6% chance of exploitation in the next 30 days. OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed,…
CVE-2022-3602, published 2022-11-01. High severity, CVSS 7.5. EPSS: 90.8% chance of exploitation in the next 30 days. A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either…
CVE-2020-11984, published 2020-08-07. Critical severity, CVSS 9.8. EPSS: 90% chance of exploitation in the next 30 days. Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
CVE-2022-30522, published 2022-06-09. High severity, CVSS 7.5. EPSS: 89.5% chance of exploitation in the next 30 days. If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and…
CVE-2021-3711, published 2021-08-24. Critical severity, CVSS 9.8. EPSS: 87.8% chance of exploitation in the next 30 days. In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the…
CVE-2017-15715, published 2018-03-26. High severity, CVSS 8.1. EPSS: 85.5% chance of exploitation in the next 30 days. In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could…
CVE-2022-1292, published 2022-05-03. High severity, CVSS 7.3. EPSS: 82.6% chance of exploitation in the next 30 days. The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed.…
CVE-2015-7871, published 2017-08-07. Critical severity, CVSS 9.8. EPSS: 81.8% chance of exploitation in the next 30 days. Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.

Latest

CVE-2024-38477, published 2024-07-01. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60,…
CVE-2024-38476, published 2024-07-01. Critical severity, CVSS 9.8. EPSS: 41.6% chance of exploitation in the next 30 days. Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious…
CVE-2024-38474, published 2024-07-01. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by…
CVE-2024-21985, published 2024-01-26. High severity, CVSS 7.6. EPSS: 0.3% chance of exploitation in the next 30 days. ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user with multiple remote accounts with…
CVE-2024-21982, published 2024-01-12. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. ONTAP versions 9.4 and higher are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information to unprivileged attackers when the object-store…
CVE-2023-27314, published 2023-10-12. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to cause a crash of the…
CVE-2023-36054, published 2023-08-07. Medium severity, CVSS 6.5. EPSS: 2.8% chance of exploitation in the next 30 days. lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs…
CVE-2023-3107, published 2023-08-01. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A set of carefully crafted ipv6 packets can trigger an integer overflow in the calculation of a fragment reassembled packet's payload length field. This allows an attacker to trigger a kernel panic,…
CVE-2023-38403, published 2023-07-17. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.
CVE-2023-2953, published 2023-05-30. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.