Netapp Max Data vulnerabilities

7 CVEs affecting Netapp Max Data, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-7699, published 2020-07-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability, published 2020-04-29. Medium severity, CVSS 6.1. Actively exploited: in CISA KEV since 2025-01-23. EPSS: 84.9% chance of exploitation in the next 30 days. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation…
CVE-2020-11022, published 2020-04-29. Medium severity, CVSS 6.1. EPSS: 99.2% chance of exploitation in the next 30 days. In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may…
CVE-2020-7699, published 2020-07-30. Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days. This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.
CVE-2020-15801, published 2020-07-17. Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days. In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file)…
CVE-2020-14968, published 2020-06-22. Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days. An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implementation does not detect signature manipulation/modification by prepending '\0' bytes to a…
CVE-2020-14967, published 2020-06-22. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to…
CVE-2020-14966, published 2020-06-22. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters…