Netapp h610s Firmware vulnerabilities

62 CVEs affecting Netapp h610s Firmware, 4 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-0167, published 2025-02-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-22555: Linux Kernel Heap Out-of-Bounds Write Vulnerability, published 2021-07-07. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2025-10-06. EPSS: 78.7% chance of exploitation in the next 30 days. A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through…
CVE-2019-2215: Android Kernel Use-After-Free Vulnerability, published 2019-10-11. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 72.1% chance of exploitation in the next 30 days. A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require…
CVE-2019-13272: Linux Kernel Improper Privilege Management Vulnerability, published 2019-07-17. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 52.2% chance of exploitation in the next 30 days. In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to…
CVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerability, published 2022-03-25. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-08-26. EPSS: 8.9% chance of exploitation in the next 30 days. An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user…
CVE-2022-2068, published 2022-06-21. High severity, CVSS 7.3. EPSS: 96.4% chance of exploitation in the next 30 days. In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command…
CVE-2024-6119, published 2024-09-03. High severity, CVSS 7.5. EPSS: 66.6% chance of exploitation in the next 30 days. Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the…
CVE-2024-2398, published 2024-03-27. High severity, CVSS 8.6. EPSS: 36.1% chance of exploitation in the next 30 days. When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push.…
CVE-2019-5108, published 2019-12-23. Medium severity, CVSS 6.5. EPSS: 10.1% chance of exploitation in the next 30 days. An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for…
CVE-2019-10126, published 2019-06-14. Critical severity, CVSS 9.8. EPSS: 6.8% chance of exploitation in the next 30 days. A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly…
CVE-2020-8835, published 2020-04-02. High severity, CVSS 7.8. EPSS: 6% chance of exploitation in the next 30 days. In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel…

Latest

CVE-2025-0167, published 2025-02-05. Low severity, CVSS 3.4. EPSS: 0.7% chance of exploitation in the next 30 days. When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This…
CVE-2024-11053, published 2024-12-11. Low severity, CVSS 3.4. EPSS: 2% chance of exploitation in the next 30 days. When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This…
CVE-2024-33601, published 2024-05-06. High severity, CVSS 7.3. EPSS: 1.1% chance of exploitation in the next 30 days. nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process…
CVE-2024-33600, published 2024-05-06. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a…
CVE-2024-26735, published 2024-04-03. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix possible use-after-free and null-ptr-deref The pernet operations structure for the subsystem must be…
CVE-2024-26733, published 2024-04-03. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arp_req_get(). syzkaller reported an overflown write in arp_req_get(). [0] When ioctl(SIOCGARP) is…
CVE-2024-2379, published 2024-03-27. Medium severity, CVSS 6.3. EPSS: 1.9% chance of exploitation in the next 30 days. libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips…
CVE-2024-26633, published 2024-03-18. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is…