Netapp Hci Management Node vulnerabilities

182 CVEs affecting Netapp Hci Management Node, 4 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-38430, published 2023-07-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-3156: Sudo Heap-Based Buffer Overflow Vulnerability, published 2021-01-26. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-06. EPSS: 100% chance of exploitation in the next 30 days. Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends…
CVE-2021-22555: Linux Kernel Heap Out-of-Bounds Write Vulnerability, published 2021-07-07. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2025-10-06. EPSS: 78.7% chance of exploitation in the next 30 days. A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through…
CVE-2019-2215: Android Kernel Use-After-Free Vulnerability, published 2019-10-11. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 72.1% chance of exploitation in the next 30 days. A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require…
CVE-2019-13272: Linux Kernel Improper Privilege Management Vulnerability, published 2019-07-17. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 52.2% chance of exploitation in the next 30 days. In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to…
CVE-2021-34429, published 2021-07-15. Medium severity, CVSS 5.3. EPSS: 99.3% chance of exploitation in the next 30 days. For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security…
CVE-2019-5736, published 2019-02-11. High severity, CVSS 8.6. EPSS: 98.5% chance of exploitation in the next 30 days. runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to…
CVE-2022-2068, published 2022-06-21. High severity, CVSS 7.3. EPSS: 96.4% chance of exploitation in the next 30 days. In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command…
CVE-2021-3711, published 2021-08-24. Critical severity, CVSS 9.8. EPSS: 87.8% chance of exploitation in the next 30 days. In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the…
CVE-2022-34169, published 2022-07-19. High severity, CVSS 7.5. EPSS: 81.8% chance of exploitation in the next 30 days. The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal…
CVE-2020-27223, published 2021-02-26. Medium severity, CVSS 5.3. EPSS: 78% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q)…

Latest

CVE-2023-38430, published 2023-07-18. Critical severity, CVSS 9.1. EPSS: 1.2% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read.
CVE-2023-32254, published 2023-07-10. High severity, CVSS 8.1. EPSS: 2.9% chance of exploitation in the next 30 days. A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack…
CVE-2022-35252, published 2022-09-23. Low severity, CVSS 3.7. EPSS: 3.8% chance of exploitation in the next 30 days. When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses.…
CVE-2022-21549, published 2022-07-19. Medium severity, CVSS 5.3. EPSS: 2.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle…
CVE-2022-21541, published 2022-07-19. Medium severity, CVSS 5.9. EPSS: 2.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333,…
CVE-2022-21540, published 2022-07-19. Medium severity, CVSS 5.3. EPSS: 4.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333,…
CVE-2022-32208, published 2022-07-07. Medium severity, CVSS 5.9. EPSS: 8.4% chance of exploitation in the next 30 days. When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it…
CVE-2022-32207, published 2022-07-07. Critical severity, CVSS 9.8. EPSS: 12.3% chance of exploitation in the next 30 days. When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In…
CVE-2022-32206, published 2022-07-07. Medium severity, CVSS 6.5. EPSS: 36.3% chance of exploitation in the next 30 days. curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable…