Netapp Data Availability Services vulnerabilities

61 CVEs affecting Netapp Data Availability Services, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-9391, published 2020-02-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-1938: Apache Tomcat Improper Privilege Management Vulnerability, published 2020-02-24. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 99.3% chance of exploitation in the next 30 days. When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar…
CVE-2019-2215: Android Kernel Use-After-Free Vulnerability, published 2019-10-11. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 72.1% chance of exploitation in the next 30 days. A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require…
CVE-2020-5398, published 2020-01-17. High severity, CVSS 7.5. EPSS: 88.8% chance of exploitation in the next 30 days. In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it…
CVE-2019-5108, published 2019-12-23. Medium severity, CVSS 6.5. EPSS: 10.1% chance of exploitation in the next 30 days. An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for…
CVE-2020-1935, published 2020-02-24. Medium severity, CVSS 4.8. EPSS: 9.4% chance of exploitation in the next 30 days. In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as…
CVE-2019-17569, published 2020-02-24. Medium severity, CVSS 4.8. EPSS: 8.9% chance of exploitation in the next 30 days. The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were…
CVE-2019-19052, published 2019-11-18. High severity, CVSS 7.5. EPSS: 5.2% chance of exploitation in the next 30 days. A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering…
CVE-2019-19050, published 2019-11-18. High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days. A memory leak in the crypto_reportstat() function in crypto/crypto_user_stat.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering…
CVE-2019-19044, published 2019-11-18. High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days. Two memory leaks in the v3d_submit_cl_ioctl() function in drivers/gpu/drm/v3d/v3d_gem.c in the Linux kernel before 5.3.11 allow attackers to cause a denial of service (memory consumption) by…
CVE-2019-15538, published 2019-08-25. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota.…

Latest

CVE-2020-9391, published 2020-02-25. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory…
CVE-2020-9383, published 2020-02-25. High severity, CVSS 7.1. EPSS: 0.8% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before…
CVE-2020-8992, published 2020-02-14. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size.
CVE-2019-18282, published 2020-01-16. Medium severity, CVSS 5.3. EPSS: 2.6% chance of exploitation in the next 30 days. The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet…
CVE-2019-20095, published 2019-12-30. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82. This…
CVE-2019-20054, published 2019-12-28. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e.