Netapp Management Services For Element Software vulnerabilities

27 CVEs affecting Netapp Management Services For Element Software, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-36054, published 2023-08-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-28169, published 2021-06-09. Medium severity, CVSS 5.3. EPSS: 78.5% chance of exploitation in the next 30 days. For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For…
CVE-2020-27223, published 2021-02-26. Medium severity, CVSS 5.3. EPSS: 78% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q)…
CVE-2018-25032, published 2022-03-25. High severity, CVSS 7.5. EPSS: 51.7% chance of exploitation in the next 30 days. zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
CVE-2023-24329, published 2023-02-17. High severity, CVSS 7.5. EPSS: 20.5% chance of exploitation in the next 30 days. An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
CVE-2022-37434, published 2022-08-05. Critical severity, CVSS 9.8. EPSS: 19% chance of exploitation in the next 30 days. zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected.…
CVE-2021-32626, published 2021-10-04. High severity, CVSS 8.8. EPSS: 16.2% chance of exploitation in the next 30 days. Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to…
CVE-2021-32675, published 2021-10-04. High severity, CVSS 7.5. EPSS: 16.1% chance of exploitation in the next 30 days. Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which…
CVE-2021-32628, published 2021-10-04. High severity, CVSS 7.5. EPSS: 13.5% chance of exploitation in the next 30 days. Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and…
CVE-2021-3737, published 2022-03-04. High severity, CVSS 7.5. EPSS: 13.2% chance of exploitation in the next 30 days. A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an…
CVE-2021-42340, published 2021-10-14. High severity, CVSS 7.5. EPSS: 11.8% chance of exploitation in the next 30 days. The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics…

Latest

CVE-2023-36054, published 2023-08-07. Medium severity, CVSS 6.5. EPSS: 2.8% chance of exploitation in the next 30 days. lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs…
CVE-2023-37920, published 2023-07-25. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes…
CVE-2022-23491, published 2022-12-07. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates…
CVE-2022-38023, published 2022-11-09. High severity, CVSS 8.1. EPSS: 2.4% chance of exploitation in the next 30 days. Netlogon RPC Elevation of Privilege Vulnerability
CVE-2022-37967, published 2022-11-09. High severity, CVSS 7.2. EPSS: 4.2% chance of exploitation in the next 30 days. Windows Kerberos Elevation of Privilege Vulnerability
CVE-2022-37966, published 2022-11-09. High severity, CVSS 8.1. EPSS: 2.5% chance of exploitation in the next 30 days. Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability
CVE-2022-45061, published 2022-11-09. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably…
CVE-2022-36033, published 2022-08-29. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which…