Netapp h410c Firmware vulnerabilities

241 CVEs affecting Netapp h410c Firmware, 13 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-54085, published 2025-03-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-0847: Linux Kernel Privilege Escalation Vulnerability, published 2022-03-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-25. EPSS: 92.8% chance of exploitation in the next 30 days. A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus…
CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability, published 2020-04-29. Medium severity, CVSS 6.1. Actively exploited: in CISA KEV since 2025-01-23. EPSS: 84.9% chance of exploitation in the next 30 days. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation…
CVE-2021-22555: Linux Kernel Heap Out-of-Bounds Write Vulnerability, published 2021-07-07. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2025-10-06. EPSS: 78.7% chance of exploitation in the next 30 days. A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through…
CVE-2019-2215: Android Kernel Use-After-Free Vulnerability, published 2019-10-11. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 72.1% chance of exploitation in the next 30 days. A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require…
CVE-2023-4911: GNU C Library Buffer Overflow Vulnerability, published 2023-10-03. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-11-21. EPSS: 63.8% chance of exploitation in the next 30 days. A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously…
CVE-2024-54085: AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability, published 2025-03-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-06-25. EPSS: 60.7% chance of exploitation in the next 30 days. AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a…
CVE-2019-13272: Linux Kernel Improper Privilege Management Vulnerability, published 2019-07-17. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 52.2% chance of exploitation in the next 30 days. In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to…
CVE-2024-1086: Linux Kernel Use-After-Free Vulnerability, published 2024-01-31. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2024-05-30. EPSS: 28.1% chance of exploitation in the next 30 days. A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values…
CVE-2022-0185: Linux Kernel Heap-Based Buffer Overflow Vulnerability, published 2022-02-11. High severity, CVSS 8.4. Actively exploited: in CISA KEV since 2024-08-21. EPSS: 25.2% chance of exploitation in the next 30 days. A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An…
CVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerability, published 2022-03-25. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-08-26. EPSS: 8.9% chance of exploitation in the next 30 days. An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user…

Latest

CVE-2025-24928, published 2025-02-18. High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days. libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted…
CVE-2024-56171, published 2025-02-18. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be…
CVE-2025-0665, published 2025-02-05. High severity, CVSS 7.0. EPSS: 1.3% chance of exploitation in the next 30 days. libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.
CVE-2025-0167, published 2025-02-05. Low severity, CVSS 3.4. EPSS: 0.7% chance of exploitation in the next 30 days. When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This…
CVE-2024-40896, published 2024-12-23. Critical severity, CVSS 9.1. EPSS: 1.2% chance of exploitation in the next 30 days. In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by…
CVE-2024-50602, published 2024-10-27. Medium severity, CVSS 5.9. EPSS: 1.1% chance of exploitation in the next 30 days. An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.
CVE-2024-6119, published 2024-09-03. High severity, CVSS 7.5. EPSS: 66.6% chance of exploitation in the next 30 days. Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the…
CVE-2024-36958, published 2024-05-30. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix nfsd4_encode_fattr4() crasher Ensure that args.acl is initialized early. It is used in an unconditional call to kfree()…
CVE-2024-33602, published 2024-05-06. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the…