Netapp Oncommand Shift vulnerabilities

64 CVEs affecting Netapp Oncommand Shift, 4 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-7525, published 2018-02-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-12617: Apache Tomcat Remote Code Execution Vulnerability, published 2017-10-04. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 100% chance of exploitation in the next 30 days. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the…
CVE-2017-12615: Apache Tomcat on Windows Remote Code Execution Vulnerability, published 2017-09-19. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 99.6% chance of exploitation in the next 30 days. When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to…
CVE-2016-3427: Oracle Java SE and JRockit Unspecified Vulnerability, published 2016-04-21. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 92.3% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability, published 2017-04-06. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 90.3% chance of exploitation in the next 30 days. Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an…
CVE-2017-17485, published 2018-01-10. Critical severity, CVSS 9.8. EPSS: 49.7% chance of exploitation in the next 30 days. FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is…
CVE-2017-7525, published 2018-02-06. Critical severity, CVSS 9.8. EPSS: 37.7% chance of exploitation in the next 30 days. A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the…
CVE-2017-10355, published 2017-10-19. Medium severity, CVSS 5.3. EPSS: 16.2% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE…
CVE-2016-5018, published 2017-08-10. Critical severity, CVSS 9.1. EPSS: 10.3% chance of exploitation in the next 30 days. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a…
CVE-2017-10309, published 2017-10-19. High severity, CVSS 7.1. EPSS: 8.8% chance of exploitation in the next 30 days. Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 8u144 and 9. Easily exploitable vulnerability allows…
CVE-2017-15095, published 2018-02-06. Critical severity, CVSS 9.8. EPSS: 8.4% chance of exploitation in the next 30 days. A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously…

Latest

CVE-2018-5968, published 2018-01-22. High severity, CVSS 8.1. EPSS: 7.2% chance of exploitation in the next 30 days. FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization…
CVE-2018-2638, published 2018-01-18. High severity, CVSS 8.3. EPSS: 3.3% chance of exploitation in the next 30 days. Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 8u152 and 9.0.1. Difficult to exploit vulnerability allows…
CVE-2018-2627, published 2018-01-18. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Installer). Supported versions that are affected are Java SE: 8u152 and 9.0.1. Difficult to exploit vulnerability allows low…
CVE-2018-2581, published 2018-01-18. Medium severity, CVSS 4.7. EPSS: 2.5% chance of exploitation in the next 30 days. Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u161, 8u152 and 9.0.1. Easily exploitable vulnerability allows…
CVE-2017-10388, published 2017-10-19. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded:…
CVE-2017-10357, published 2017-10-19. Medium severity, CVSS 5.3. EPSS: 3.3% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE…
CVE-2017-10356, published 2017-10-19. Medium severity, CVSS 6.2. EPSS: 0.8% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE…