Netapp NextGen API vulnerabilities

4 CVEs affecting Netapp NextGen API, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22930, published 2021-10-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-22930, published 2021-10-07. Critical severity, CVSS 9.8. EPSS: 36.5% chance of exploitation in the next 30 days. Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
CVE-2021-22931, published 2021-08-16. Critical severity, CVSS 9.8. EPSS: 22% chance of exploitation in the next 30 days. Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js…
CVE-2021-22939, published 2021-08-16. Medium severity, CVSS 5.3. EPSS: 14.7% chance of exploitation in the next 30 days. If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would…
CVE-2021-22940, published 2021-08-16. High severity, CVSS 7.5. EPSS: 13.9% chance of exploitation in the next 30 days. Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.