Netapp Hci Bootstrap OS vulnerabilities

27 CVEs affecting Netapp Hci Bootstrap OS, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-33602, published 2024-05-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-8285, published 2020-12-14. High severity, CVSS 7.5. EPSS: 9.8% chance of exploitation in the next 30 days. curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
CVE-2019-0201, published 2019-05-23. Medium severity, CVSS 5.9. EPSS: 9.7% chance of exploitation in the next 30 days. An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and…
CVE-2020-16166, published 2020-07-30. Low severity, CVSS 3.7. EPSS: 5.2% chance of exploitation in the next 30 days. The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is…
CVE-2020-8286, published 2020-12-14. High severity, CVSS 7.5. EPSS: 4.6% chance of exploitation in the next 30 days. curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
CVE-2022-27776, published 2022-06-02. Medium severity, CVSS 6.5. EPSS: 4.1% chance of exploitation in the next 30 days. A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
CVE-2020-8284, published 2020-12-14. Low severity, CVSS 3.7. EPSS: 3.9% chance of exploitation in the next 30 days. A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about…
CVE-2021-38201, published 2021-08-08. High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days. net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.
CVE-2022-27775, published 2022-06-02. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a…
CVE-2021-38202, published 2021-08-08. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is…
CVE-2023-28531, published 2023-03-17. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

Latest

CVE-2024-33602, published 2024-05-06. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the…
CVE-2024-33601, published 2024-05-06. High severity, CVSS 7.3. EPSS: 1.1% chance of exploitation in the next 30 days. nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process…
CVE-2024-33600, published 2024-05-06. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a…
CVE-2024-33599, published 2024-05-06. High severity, CVSS 8.1. EPSS: 1.3% chance of exploitation in the next 30 days. nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may…
CVE-2023-29153, published 2024-02-14. Medium severity, CVSS 4.9. EPSS: 0.7% chance of exploitation in the next 30 days. Uncontrolled resource consumption for some Intel(R) SPS firmware before version SPS_E5_06.01.04.002.0 may allow a privileged user to potentially enable denial of service via network access.
CVE-2021-4209, published 2022-08-24. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of…
CVE-2022-36879, published 2022-07-27. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.
CVE-2022-30115, published 2022-06-02. Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days. Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the…
CVE-2022-27781, published 2022-06-02. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make…