Netapp CN1610 Firmware vulnerabilities

22 CVEs affecting Netapp CN1610 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-10126, published 2019-06-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-15473, published 2018-08-17. Medium severity, CVSS 5.3. EPSS: 98.6% chance of exploitation in the next 30 days. OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed,…
CVE-2016-8610, published 2017-11-13. High severity, CVSS 7.5. EPSS: 39.7% chance of exploitation in the next 30 days. A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote…
CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
CVE-2018-0734, published 2018-10-30. Medium severity, CVSS 5.9. EPSS: 12.2% chance of exploitation in the next 30 days. The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in…
CVE-2019-10126, published 2019-06-14. Critical severity, CVSS 9.8. EPSS: 6.8% chance of exploitation in the next 30 days. A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly…
CVE-2019-3846, published 2019-06-03. High severity, CVSS 8.8. EPSS: 5.9% chance of exploitation in the next 30 days. A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network.
CVE-2019-10125, published 2019-03-27. Critical severity, CVSS 9.8. EPSS: 5.3% chance of exploitation in the next 30 days. An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be released by aio_poll_wake() if an expected event is triggered immediately (e.g., by the close of a…
CVE-2019-9003, published 2019-02-22. High severity, CVSS 7.5. EPSS: 4.8% chance of exploitation in the next 30 days. In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by…
CVE-2018-0735, published 2018-10-29. Medium severity, CVSS 5.9. EPSS: 4.7% chance of exploitation in the next 30 days. The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in…
CVE-2019-11815, published 2019-05-08. High severity, CVSS 8.1. EPSS: 4.4% chance of exploitation in the next 30 days. An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cleanup.

Latest

CVE-2019-12615, published 2019-06-03. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. An issue was discovered in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup_const of node_info->vdev_port.name, which might allow…
CVE-2018-20839, published 2019-05-17. Medium severity, CVSS 4.3. EPSS: 2.5% chance of exploitation in the next 30 days. systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This…
CVE-2019-3844, published 2019-04-26. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service…
CVE-2019-3843, published 2019-04-26. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is…
CVE-2019-3900, published 2019-04-25. High severity, CVSS 7.7. EPSS: 4.3% chance of exploitation in the next 30 days. An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets…
CVE-2019-3882, published 2019-04-24. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local…
CVE-2019-3901, published 2019-04-22. Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days. A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the…