Netapp Data Ontap Edge vulnerabilities

23 CVEs affecting Netapp Data Ontap Edge, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-5740, published 2019-01-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-15473, published 2018-08-17. Medium severity, CVSS 5.3. EPSS: 98.6% chance of exploitation in the next 30 days. OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed,…
CVE-2018-5740, published 2019-01-16. High severity, CVSS 7.5. EPSS: 59.6% chance of exploitation in the next 30 days. "deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used…
CVE-2016-9131, published 2017-01-12. High severity, CVSS 7.5. EPSS: 40.6% chance of exploitation in the next 30 days. named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed…
CVE-2016-8610, published 2017-11-13. High severity, CVSS 7.5. EPSS: 39.7% chance of exploitation in the next 30 days. A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote…
CVE-2016-8864, published 2016-11-02. High severity, CVSS 7.5. EPSS: 38.7% chance of exploitation in the next 30 days. named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record…
CVE-2017-3145, published 2019-01-16. High severity, CVSS 7.5. EPSS: 27.9% chance of exploitation in the next 30 days. BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named.…
CVE-2018-5736, published 2019-01-16. Medium severity, CVSS 5.3. EPSS: 18% chance of exploitation in the next 30 days. An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession.…
CVE-2017-3135, published 2019-01-16. Medium severity, CVSS 5.9. EPSS: 17.2% chance of exploitation in the next 30 days. Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to…
CVE-2016-10708, published 2018-01-21. High severity, CVSS 7.5. EPSS: 15.7% chance of exploitation in the next 30 days. sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz,…
CVE-2017-3140, published 2019-01-16. Medium severity, CVSS 5.9. EPSS: 12.2% chance of exploitation in the next 30 days. If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while handling a query. Affects BIND 9.9.10,…

Latest

CVE-2018-5737, published 2019-01-16. High severity, CVSS 7.5. EPSS: 10.4% chance of exploitation in the next 30 days. A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction…
CVE-2018-5734, published 2019-01-16. High severity, CVSS 7.5. EPSS: 6.3% chance of exploitation in the next 30 days. While handling a particular type of malformed packet BIND erroneously selects a SERVFAIL rcode instead of a FORMERR rcode. If the receiving view has the SERVFAIL cache feature enabled, this can…
CVE-2017-3138, published 2019-01-16. Medium severity, CVSS 5.3. EPSS: 5.5% chance of exploitation in the next 30 days. named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A…
CVE-2017-3137, published 2019-01-16. High severity, CVSS 7.5. EPSS: 9% chance of exploitation in the next 30 days. Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion…
CVE-2017-3136, published 2019-01-16. Medium severity, CVSS 5.9. EPSS: 11.2% chance of exploitation in the next 30 days. A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling…