Netapp Data Ontap vulnerabilities

42 CVEs affecting Netapp Data Ontap, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-26989, published 2021-03-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-15473, published 2018-08-17. Medium severity, CVSS 5.3. EPSS: 98.6% chance of exploitation in the next 30 days. OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed,…
CVE-2015-7871, published 2017-08-07. Critical severity, CVSS 9.8. EPSS: 81.8% chance of exploitation in the next 30 days. Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
CVE-2016-8610, published 2017-11-13. High severity, CVSS 7.5. EPSS: 39.7% chance of exploitation in the next 30 days. A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote…
CVE-2015-7855, published 2017-08-07. Medium severity, CVSS 6.5. EPSS: 31.1% chance of exploitation in the next 30 days. The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a…
CVE-2018-18065, published 2018-10-08. Medium severity, CVSS 6.5. EPSS: 17.5% chance of exploitation in the next 30 days. _set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted…
CVE-2015-7849, published 2017-08-07. High severity, CVSS 8.8. EPSS: 16.8% chance of exploitation in the next 30 days. Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code or cause a denial of service (crash) via…
CVE-2016-10708, published 2018-01-21. High severity, CVSS 7.5. EPSS: 15.7% chance of exploitation in the next 30 days. sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz,…
CVE-2016-2518, published 2017-01-30. Medium severity, CVSS 5.3. EPSS: 15.1% chance of exploitation in the next 30 days. The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.
CVE-2015-7854, published 2017-08-07. High severity, CVSS 8.8. EPSS: 14.6% chance of exploitation in the next 30 days. Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (daemon crash) or possibly…
CVE-2015-7852, published 2017-08-07. Medium severity, CVSS 5.9. EPSS: 12.3% chance of exploitation in the next 30 days. ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.

Latest

CVE-2021-26989, published 2021-03-04. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P9 and 9.8 are susceptible to a vulnerability which could allow a remote authenticated attacker to cause a Denial of Service (DoS) on…
CVE-2021-26988, published 2021-03-04. Low severity, CVSS 3.5. EPSS: 0.4% chance of exploitation in the next 30 days. Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P8 and 9.8 are susceptible to a vulnerability which could allow unauthorized tenant users to discover information related to…
CVE-2020-1971, published 2020-12-08. Medium severity, CVSS 5.9. EPSS: 7.1% chance of exploitation in the next 30 days. The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares…
CVE-2020-13817, published 2020-06-04. High severity, CVSS 7.4. EPSS: 3.3% chance of exploitation in the next 30 days. ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed…
CVE-2020-11868, published 2020-04-17. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because…
CVE-2019-5502, published 2019-08-05. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. SMB in Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 has weak cryptography which when exploited could lead to information disclosure or addition or modification of data.
CVE-2019-5501, published 2019-08-02. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 may disclose sensitive LDAP account information to unauthenticated remote attackers.
CVE-2019-5493, published 2019-08-02. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 are susceptible to a vulnerability which discloses information to an unauthenticated attacker. A successful attack requires that multiple…
CVE-2019-8936, published 2019-05-15. High severity, CVSS 7.5. EPSS: 5.7% chance of exploitation in the next 30 days. NTP through 4.2.8p12 has a NULL Pointer Dereference.
CVE-2018-5496, published 2018-12-04. Medium severity, CVSS 4.4. EPSS: 0.4% chance of exploitation in the next 30 days. Data ONTAP operating in 7-Mode versions prior to 8.2.5P2 are susceptible to a vulnerability which discloses sensitive information to an unauthorized user.