Netapp E-Series Santricity Web Services vulnerabilities

99 CVEs affecting Netapp E-Series Santricity Web Services, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-26049, published 2023-04-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-3427: Oracle Java SE and JRockit Unspecified Vulnerability, published 2016-04-21. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 92.3% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2021-34429, published 2021-07-15. Medium severity, CVSS 5.3. EPSS: 99.3% chance of exploitation in the next 30 days. For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security…
CVE-2021-28164, published 2021-04-01. Medium severity, CVSS 5.3. EPSS: 82.4% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF…
CVE-2020-27223, published 2021-02-26. Medium severity, CVSS 5.3. EPSS: 78% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q)…
CVE-2022-21449, published 2022-04-19. High severity, CVSS 7.5. EPSS: 77.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle…
CVE-2021-28165, published 2021-04-01. High severity, CVSS 7.5. EPSS: 53.9% chance of exploitation in the next 30 days. In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVE-2017-7658, published 2018-06-26. Critical severity, CVSS 9.8. EPSS: 19.4% chance of exploitation in the next 30 days. In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the…
CVE-2021-3517, published 2021-05-19. High severity, CVSS 8.6. EPSS: 17% chance of exploitation in the next 30 days. There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the…
CVE-2017-10355, published 2017-10-19. Medium severity, CVSS 5.3. EPSS: 16.2% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE…
CVE-2021-35559, published 2021-10-20. Medium severity, CVSS 5.3. EPSS: 15.9% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle…

Latest

CVE-2023-26049, published 2023-04-18. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by…
CVE-2022-21496, published 2022-04-19. Medium severity, CVSS 5.3. EPSS: 2.8% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14,…
CVE-2022-21476, published 2022-04-19. High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321,…
CVE-2022-21443, published 2022-04-19. Low severity, CVSS 3.7. EPSS: 2.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321,…
CVE-2022-21434, published 2022-04-19. Medium severity, CVSS 5.3. EPSS: 2.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321,…
CVE-2022-21426, published 2022-04-19. Medium severity, CVSS 5.3. EPSS: 3.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14,…
CVE-2022-21366, published 2022-01-19. Medium severity, CVSS 5.3. EPSS: 3.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle…
CVE-2022-21365, published 2022-01-19. Medium severity, CVSS 5.3. EPSS: 3.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13,…
CVE-2022-21360, published 2022-01-19. Medium severity, CVSS 5.3. EPSS: 3.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13,…