Netapp Oncommand Unified Manager Core Package vulnerabilities

11 CVEs affecting Netapp Oncommand Unified Manager Core Package, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-3156, published 2021-01-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-3156: Sudo Heap-Based Buffer Overflow Vulnerability, published 2021-01-26. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-06. EPSS: 100% chance of exploitation in the next 30 days. Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends…
CVE-2020-1927, published 2020-04-02. Medium severity, CVSS 6.1. EPSS: 56.7% chance of exploitation in the next 30 days. In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL…
CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
CVE-2021-23926, published 2021-01-14. Critical severity, CVSS 9.1. EPSS: 6.3% chance of exploitation in the next 30 days. The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion…
CVE-2020-14621, published 2020-07-15. Medium severity, CVSS 5.3. EPSS: 4.4% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251.…
CVE-2020-14779, published 2020-10-21. Low severity, CVSS 3.7. EPSS: 3.8% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded:…
CVE-2017-15906, published 2017-10-26. Medium severity, CVSS 5.3. EPSS: 3.4% chance of exploitation in the next 30 days. The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
CVE-2020-14002, published 2020-06-29. Medium severity, CVSS 5.9. EPSS: 3.1% chance of exploitation in the next 30 days. PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where…
CVE-2019-17069, published 2019-10-01. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.
CVE-2017-7439, published 2017-05-26. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors involving error messages.