Netapp Element Software vulnerabilities

100 CVEs affecting Netapp Element Software, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-0167, published 2025-02-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-2068, published 2022-06-21. High severity, CVSS 7.3. EPSS: 96.4% chance of exploitation in the next 30 days. In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command…
CVE-2022-32206, published 2022-07-07. Medium severity, CVSS 6.5. EPSS: 36.3% chance of exploitation in the next 30 days. curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable…
CVE-2022-32205, published 2022-07-07. Medium severity, CVSS 4.3. EPSS: 31.5% chance of exploitation in the next 30 days. A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent…
CVE-2018-7182, published 2018-03-06. High severity, CVSS 7.5. EPSS: 28.8% chance of exploitation in the next 30 days. The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6…
CVE-2019-6110, published 2019-01-31. Medium severity, CVSS 6.8. EPSS: 24.9% chance of exploitation in the next 30 days. In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI…
CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
CVE-2017-10355, published 2017-10-19. Medium severity, CVSS 5.3. EPSS: 16.2% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE…
CVE-2017-7657, published 2018-06-26. Critical severity, CVSS 9.8. EPSS: 14.9% chance of exploitation in the next 30 days. In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk…
CVE-2019-3462, published 2019-01-28. High severity, CVSS 8.1. EPSS: 14.6% chance of exploitation in the next 30 days. Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code…
CVE-2022-32207, published 2022-07-07. Critical severity, CVSS 9.8. EPSS: 12.3% chance of exploitation in the next 30 days. When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In…

Latest

CVE-2025-0167, published 2025-02-05. Low severity, CVSS 3.4. EPSS: 0.7% chance of exploitation in the next 30 days. When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This…
CVE-2024-33602, published 2024-05-06. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the…
CVE-2022-45061, published 2022-11-09. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably…
CVE-2022-35252, published 2022-09-23. Low severity, CVSS 3.7. EPSS: 3.8% chance of exploitation in the next 30 days. When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses.…
CVE-2022-32208, published 2022-07-07. Medium severity, CVSS 5.9. EPSS: 8.4% chance of exploitation in the next 30 days. When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it…
CVE-2022-1678, published 2022-05-25. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be used by remote clients.