Netapp Oncommand Unified Manager vulnerabilities

169 CVEs affecting Netapp Oncommand Unified Manager, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-8585, published 2021-01-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-3427: Oracle Java SE and JRockit Unspecified Vulnerability, published 2016-04-21. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 92.3% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2010-1871: Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability, published 2010-08-05. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 83.4% chance of exploitation in the next 30 days. JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows…
CVE-2019-0211: Apache HTTP Server Privilege Escalation Vulnerability, published 2019-04-08. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 65% chance of exploitation in the next 30 days. In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process…
CVE-2018-15473, published 2018-08-17. Medium severity, CVSS 5.3. EPSS: 98.6% chance of exploitation in the next 30 days. OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed,…
CVE-2018-10933, published 2018-10-17. Critical severity, CVSS 9.1. EPSS: 91.8% chance of exploitation in the next 30 days. A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in…
CVE-2015-7871, published 2017-08-07. Critical severity, CVSS 9.8. EPSS: 81.8% chance of exploitation in the next 30 days. Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
CVE-2017-7668, published 2017-06-20. High severity, CVSS 7.5. EPSS: 57.5% chance of exploitation in the next 30 days. The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously…
CVE-2017-9788, published 2017-07-13. Critical severity, CVSS 9.1. EPSS: 56.8% chance of exploitation in the next 30 days. In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value…
CVE-2016-8610, published 2017-11-13. High severity, CVSS 7.5. EPSS: 39.7% chance of exploitation in the next 30 days. A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote…
CVE-2015-7855, published 2017-08-07. Medium severity, CVSS 6.5. EPSS: 31.1% chance of exploitation in the next 30 days. The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a…

Latest

CVE-2020-8585, published 2021-01-28. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. OnCommand Unified Manager Core Package versions prior to 5.2.5 may disclose sensitive account information to unauthorized users via the use of PuTTY Link (plink).
CVE-2020-14803, published 2020-10-21. Medium severity, CVSS 5.3. EPSS: 3.2% chance of exploitation in the next 30 days. Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated…
CVE-2020-14798, published 2020-10-21. Low severity, CVSS 3.1. EPSS: 2.7% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded:…
CVE-2020-14797, published 2020-10-21. Low severity, CVSS 3.7. EPSS: 2.2% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded:…
CVE-2020-14796, published 2020-10-21. Low severity, CVSS 3.1. EPSS: 2.5% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded:…
CVE-2020-14792, published 2020-10-21. Medium severity, CVSS 4.2. EPSS: 2.2% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261.…
CVE-2019-18276, published 2019-11-28. High severity, CVSS 7.8. EPSS: 2.6% chance of exploitation in the next 30 days. An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by…
CVE-2019-5482, published 2019-09-16. Critical severity, CVSS 9.8. EPSS: 17.9% chance of exploitation in the next 30 days. Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVE-2019-5443, published 2019-07-02. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine")…
CVE-2019-5495, published 2019-05-10. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via…