Netapp Hyper Converged Infrastructure vulnerabilities

5 CVEs affecting Netapp Hyper Converged Infrastructure, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-1559, published 2019-02-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-18065, published 2018-10-08. Medium severity, CVSS 6.5. EPSS: 17.5% chance of exploitation in the next 30 days. _set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted…
CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
CVE-2018-1000656, published 2018-08-20. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of…
CVE-2018-18066, published 2018-10-08. High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days. snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted…
CVE-2018-12538, published 2018-06-22. High severity, CVSS 8.8. EPSS: 2.7% chance of exploitation in the next 30 days. In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to…