Netapp E-Series Performance Analyzer vulnerabilities

61 CVEs affecting Netapp E-Series Performance Analyzer, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-23491, published 2022-12-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-13272: Linux Kernel Improper Privilege Management Vulnerability, published 2019-07-17. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 52.2% chance of exploitation in the next 30 days. In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to…
CVE-2020-13379, published 2020-06-03. High severity, CVSS 8.2. EPSS: 99.9% chance of exploitation in the next 30 days. The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL…
CVE-2021-27358, published 2021-03-18. High severity, CVSS 7.5. EPSS: 83% chance of exploitation in the next 30 days. The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.
CVE-2021-28164, published 2021-04-01. Medium severity, CVSS 5.3. EPSS: 82.4% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF…
CVE-2021-22883, published 2021-03-03. High severity, CVSS 7.5. EPSS: 77.4% chance of exploitation in the next 30 days. Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of…
CVE-2022-31097, published 2022-07-15. High severity, CVSS 8.7. EPSS: 70.1% chance of exploitation in the next 30 days. Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the…
CVE-2021-3449, published 2021-03-25. Medium severity, CVSS 5.9. EPSS: 63.5% chance of exploitation in the next 30 days. An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where…
CVE-2021-28165, published 2021-04-01. High severity, CVSS 7.5. EPSS: 53.9% chance of exploitation in the next 30 days. In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVE-2020-1967, published 2020-04-21. High severity, CVSS 7.5. EPSS: 53.3% chance of exploitation in the next 30 days. Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the…
CVE-2021-4044, published 2021-12-14. High severity, CVSS 7.5. EPSS: 50.1% chance of exploitation in the next 30 days. Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error…

Latest

CVE-2022-23491, published 2022-12-07. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates…
CVE-2022-45061, published 2022-11-09. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably…
CVE-2022-31123, published 2022-10-13. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a…
CVE-2021-3999, published 2022-08-24. High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input…
CVE-2022-31107, published 2022-07-15. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a…
CVE-2022-21713, published 2022-02-08. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will…
CVE-2022-21703, published 2022-02-08. High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days. Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by…
CVE-2022-21702, published 2022-02-08. Medium severity, CVSS 5.4. EPSS: 2.3% chance of exploitation in the next 30 days. Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit…