Netapp h500e Firmware vulnerabilities

148 CVEs affecting Netapp h500e Firmware, 4 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-1882, published 2022-05-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-0847: Linux Kernel Privilege Escalation Vulnerability, published 2022-03-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-25. EPSS: 92.8% chance of exploitation in the next 30 days. A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus…
CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability, published 2020-04-29. Medium severity, CVSS 6.1. Actively exploited: in CISA KEV since 2025-01-23. EPSS: 84.9% chance of exploitation in the next 30 days. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation…
CVE-2022-0185: Linux Kernel Heap-Based Buffer Overflow Vulnerability, published 2022-02-11. High severity, CVSS 8.4. Actively exploited: in CISA KEV since 2024-08-21. EPSS: 25.2% chance of exploitation in the next 30 days. A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An…
CVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerability, published 2022-03-25. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-08-26. EPSS: 8.9% chance of exploitation in the next 30 days. An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user…
CVE-2020-11022, published 2020-04-29. Medium severity, CVSS 6.1. EPSS: 99.2% chance of exploitation in the next 30 days. In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may…
CVE-2022-1292, published 2022-05-03. High severity, CVSS 7.3. EPSS: 82.6% chance of exploitation in the next 30 days. The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed.…
CVE-2021-25216, published 2021-04-29. Critical severity, CVSS 9.8. EPSS: 82.4% chance of exploitation in the next 30 days. In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of…
CVE-2022-0435, published 2022-03-25. High severity, CVSS 8.8. EPSS: 67.8% chance of exploitation in the next 30 days. A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64…
CVE-2021-22901, published 2021-06-11. High severity, CVSS 8.1. EPSS: 63.5% chance of exploitation in the next 30 days. curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use…
CVE-2021-43267, published 2021-11-02. Critical severity, CVSS 9.8. EPSS: 57.9% chance of exploitation in the next 30 days. An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient…

Latest

CVE-2022-1882, published 2022-05-26. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called.…
CVE-2022-1678, published 2022-05-25. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be used by remote clients.
CVE-2022-1734, published 2022-05-18. High severity, CVSS 7.0. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware…
CVE-2022-29581, published 2022-05-17. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18;…
CVE-2022-1679, published 2022-05-16. High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days. A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw…
CVE-2022-1473, published 2022-05-03. High severity, CVSS 7.5. EPSS: 4.6% chance of exploitation in the next 30 days. The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding…
CVE-2022-1434, published 2022-05-03. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by…
CVE-2022-1343, published 2022-05-03. Medium severity, CVSS 5.3. EPSS: 2.1% chance of exploitation in the next 30 days. The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a…
CVE-2022-1353, published 2022-04-29. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system…