Netapp Oncommand Performance Manager vulnerabilities

73 CVEs affecting Netapp Oncommand Performance Manager, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-7525, published 2018-02-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-3427: Oracle Java SE and JRockit Unspecified Vulnerability, published 2016-04-21. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 92.3% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2016-5195: Linux Kernel Race Condition Vulnerability, published 2016-11-10. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 83.5% chance of exploitation in the next 30 days. Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a…
CVE-2015-7871, published 2017-08-07. Critical severity, CVSS 9.8. EPSS: 81.8% chance of exploitation in the next 30 days. Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
CVE-2017-7525, published 2018-02-06. Critical severity, CVSS 9.8. EPSS: 37.7% chance of exploitation in the next 30 days. A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the…
CVE-2015-7855, published 2017-08-07. Medium severity, CVSS 6.5. EPSS: 31.1% chance of exploitation in the next 30 days. The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a…
CVE-2015-7849, published 2017-08-07. High severity, CVSS 8.8. EPSS: 16.8% chance of exploitation in the next 30 days. Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code or cause a denial of service (crash) via…
CVE-2017-10355, published 2017-10-19. Medium severity, CVSS 5.3. EPSS: 16.2% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE…
CVE-2016-2518, published 2017-01-30. Medium severity, CVSS 5.3. EPSS: 15.1% chance of exploitation in the next 30 days. The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.
CVE-2015-7854, published 2017-08-07. High severity, CVSS 8.8. EPSS: 14.6% chance of exploitation in the next 30 days. Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (daemon crash) or possibly…
CVE-2015-7852, published 2017-08-07. Medium severity, CVSS 5.9. EPSS: 12.3% chance of exploitation in the next 30 days. ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.

Latest

CVE-2017-15095, published 2018-02-06. Critical severity, CVSS 9.8. EPSS: 8.4% chance of exploitation in the next 30 days. A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously…
CVE-2017-10388, published 2017-10-19. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded:…
CVE-2017-10384, published 2017-10-19. Medium severity, CVSS 6.5. EPSS: 3.1% chance of exploitation in the next 30 days. Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.57 and earlier 5.6.37 and earlier 5.7.19 and earlier. Easily…
CVE-2017-10379, published 2017-10-19. Medium severity, CVSS 6.5. EPSS: 2.3% chance of exploitation in the next 30 days. Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier.…
CVE-2017-10378, published 2017-10-19. Medium severity, CVSS 6.5. EPSS: 3.2% chance of exploitation in the next 30 days. Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.57 and earlier, 5.6.37 and earlier and 5.7.11 and earlier.…
CVE-2017-10365, published 2017-10-19. Low severity, CVSS 3.8. EPSS: 1.7% chance of exploitation in the next 30 days. Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high…
CVE-2017-10357, published 2017-10-19. Medium severity, CVSS 5.3. EPSS: 3.3% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE…
CVE-2017-10356, published 2017-10-19. Medium severity, CVSS 6.2. EPSS: 0.8% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE…