Netapp Fabric-Attached Storage a400 Firmware vulnerabilities

8 CVEs affecting Netapp Fabric-Attached Storage a400 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-1473, published 2022-05-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-1292, published 2022-05-03. High severity, CVSS 7.3. EPSS: 82.6% chance of exploitation in the next 30 days. The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed.…
CVE-2022-1473, published 2022-05-03. High severity, CVSS 7.5. EPSS: 4.6% chance of exploitation in the next 30 days. The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding…
CVE-2021-45485, published 2021-12-25. High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days. In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that…
CVE-2022-1343, published 2022-05-03. Medium severity, CVSS 5.3. EPSS: 2.1% chance of exploitation in the next 30 days. The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a…
CVE-2020-11868, published 2020-04-17. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because…
CVE-2022-1434, published 2022-05-03. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by…
CVE-2020-15436, published 2020-11-23. Medium severity, CVSS 6.7. EPSS: 0.9% chance of exploitation in the next 30 days. Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.
CVE-2019-25045, published 2021-06-07. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free, related to an xfrm_state_fini panic, aka CID-dbb2483b2a46.