Netapp Hci Baseboard Management Controller vulnerabilities

34 CVEs affecting Netapp Hci Baseboard Management Controller, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-0725, published 2025-02-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability, published 2020-04-29. Medium severity, CVSS 6.1. Actively exploited: in CISA KEV since 2025-01-23. EPSS: 84.9% chance of exploitation in the next 30 days. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation…
CVE-2023-50868, published 2024-02-14. High severity, CVSS 7.5. EPSS: 73.7% chance of exploitation in the next 30 days. The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via…
CVE-2023-32233, published 2023-05-08. High severity, CVSS 7.8. EPSS: 13.4% chance of exploitation in the next 30 days. In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged…
CVE-2019-19052, published 2019-11-18. High severity, CVSS 7.5. EPSS: 5.2% chance of exploitation in the next 30 days. A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering…
CVE-2021-45960, published 2022-01-01. High severity, CVSS 8.8. EPSS: 4.3% chance of exploitation in the next 30 days. In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing…
CVE-2021-46143, published 2022-01-06. High severity, CVSS 7.8. EPSS: 4.2% chance of exploitation in the next 30 days. In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
CVE-2019-19044, published 2019-11-18. High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days. Two memory leaks in the v3d_submit_cl_ioctl() function in drivers/gpu/drm/v3d/v3d_gem.c in the Linux kernel before 5.3.11 allow attackers to cause a denial of service (memory consumption) by…
CVE-2019-19060, published 2019-11-18. High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days. A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka…
CVE-2019-19447, published 2019-12-08. High severity, CVSS 7.8. EPSS: 3.5% chance of exploitation in the next 30 days. In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to…
CVE-2019-19061, published 2019-11-18. High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days. A memory leak in the adis_update_scan_mode_burst() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka…

Latest

CVE-2025-0725, published 2025-02-05. High severity, CVSS 7.3. EPSS: 1.8% chance of exploitation in the next 30 days. When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled…
CVE-2023-3141, published 2023-06-09. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect,…
CVE-2023-2598, published 2023-06-01. High severity, CVSS 7.8. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the Linux kernel that allows out-of-bounds access to physical memory beyond the end…
CVE-2023-2236, published 2023-05-01. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Both io_install_fixed_file and its callers call fput in a file in case…
CVE-2023-2006, published 2023-04-24. High severity, CVSS 7.0. EPSS: 0.4% chance of exploitation in the next 30 days. A race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles. This issue results from the lack of proper locking when performing operations on an…
CVE-2023-26607, published 2023-02-26. High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days. In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
CVE-2022-41858, published 2023-01-17. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker…
CVE-2023-23559, published 2023-01-13. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition.