Netapp Oncommand Balance vulnerabilities

83 CVEs affecting Netapp Oncommand Balance, 7 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-3140, published 2019-01-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-5638: Apache Struts Remote Code Execution Vulnerability, published 2017-03-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 100% chance of exploitation in the next 30 days. The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows…
CVE-2017-12617: Apache Tomcat Remote Code Execution Vulnerability, published 2017-10-04. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 100% chance of exploitation in the next 30 days. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the…
CVE-2017-12615: Apache Tomcat on Windows Remote Code Execution Vulnerability, published 2017-09-19. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 99.6% chance of exploitation in the next 30 days. When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to…
CVE-2017-9805: Apache Struts Deserialization of Untrusted Data Vulnerability, published 2017-09-15. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.4% chance of exploitation in the next 30 days. The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can…
CVE-2016-3427: Oracle Java SE and JRockit Unspecified Vulnerability, published 2016-04-21. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 92.3% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2016-5195: Linux Kernel Race Condition Vulnerability, published 2016-11-10. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 83.5% chance of exploitation in the next 30 days. Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a…
CVE-2010-1871: Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability, published 2010-08-05. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 83.4% chance of exploitation in the next 30 days. JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows…
CVE-2015-7871, published 2017-08-07. Critical severity, CVSS 9.8. EPSS: 81.8% chance of exploitation in the next 30 days. Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
CVE-2016-8610, published 2017-11-13. High severity, CVSS 7.5. EPSS: 39.7% chance of exploitation in the next 30 days. A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote…
CVE-2017-7525, published 2018-02-06. Critical severity, CVSS 9.8. EPSS: 37.7% chance of exploitation in the next 30 days. A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the…

Latest

CVE-2017-3140, published 2019-01-16. Medium severity, CVSS 5.9. EPSS: 12.2% chance of exploitation in the next 30 days. If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while handling a query. Affects BIND 9.9.10,…
CVE-2017-3138, published 2019-01-16. Medium severity, CVSS 5.3. EPSS: 5.5% chance of exploitation in the next 30 days. named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A…
CVE-2017-3137, published 2019-01-16. High severity, CVSS 7.5. EPSS: 9% chance of exploitation in the next 30 days. Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion…
CVE-2017-3136, published 2019-01-16. Medium severity, CVSS 5.9. EPSS: 11.2% chance of exploitation in the next 30 days. A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling…
CVE-2017-15095, published 2018-02-06. Critical severity, CVSS 9.8. EPSS: 8.4% chance of exploitation in the next 30 days. A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously…
CVE-2017-15707, published 2017-12-01. Medium severity, CVSS 6.2. EPSS: 4.9% chance of exploitation in the next 30 days. In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
CVE-2017-10388, published 2017-10-19. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded:…
CVE-2017-10384, published 2017-10-19. Medium severity, CVSS 6.5. EPSS: 3.1% chance of exploitation in the next 30 days. Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.57 and earlier 5.6.37 and earlier 5.7.19 and earlier. Easily…