Netapp h615c Firmware vulnerabilities

35 CVEs affecting Netapp h615c Firmware, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-0167, published 2025-02-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-22555: Linux Kernel Heap Out-of-Bounds Write Vulnerability, published 2021-07-07. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2025-10-06. EPSS: 78.7% chance of exploitation in the next 30 days. A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through…
CVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerability, published 2022-03-25. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-08-26. EPSS: 8.9% chance of exploitation in the next 30 days. An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user…
CVE-2022-2068, published 2022-06-21. High severity, CVSS 7.3. EPSS: 96.4% chance of exploitation in the next 30 days. In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command…
CVE-2024-2398, published 2024-03-27. High severity, CVSS 8.6. EPSS: 36.1% chance of exploitation in the next 30 days. When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push.…
CVE-2020-8835, published 2020-04-02. High severity, CVSS 7.8. EPSS: 6% chance of exploitation in the next 30 days. In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel…
CVE-2020-13143, published 2020-05-18. Medium severity, CVSS 6.5. EPSS: 5.2% chance of exploitation in the next 30 days. gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows…
CVE-2021-45485, published 2021-12-25. High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days. In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that…
CVE-2024-11053, published 2024-12-11. Low severity, CVSS 3.4. EPSS: 2% chance of exploitation in the next 30 days. When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This…
CVE-2024-2379, published 2024-03-27. Medium severity, CVSS 6.3. EPSS: 1.9% chance of exploitation in the next 30 days. libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips…
CVE-2021-3772, published 2022-03-02. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used…

Latest

CVE-2025-0167, published 2025-02-05. Low severity, CVSS 3.4. EPSS: 0.7% chance of exploitation in the next 30 days. When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This…
CVE-2024-33601, published 2024-05-06. High severity, CVSS 7.3. EPSS: 1.1% chance of exploitation in the next 30 days. nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process…
CVE-2024-33600, published 2024-05-06. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a…
CVE-2024-26735, published 2024-04-03. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix possible use-after-free and null-ptr-deref The pernet operations structure for the subsystem must be…
CVE-2024-26733, published 2024-04-03. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arp_req_get(). syzkaller reported an overflown write in arp_req_get(). [0] When ioctl(SIOCGARP) is…
CVE-2024-26633, published 2024-03-18. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is…
CVE-2023-52585, published 2024-03-06. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper() Return invalid error code -EINVAL for invalid…