Netapp Oncommand Unified Manager For Clustered Data Ontap vulnerabilities

4 CVEs affecting Netapp Oncommand Unified Manager For Clustered Data Ontap, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-14053, published 2017-09-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-5195: Linux Kernel Race Condition Vulnerability, published 2016-11-10. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 83.5% chance of exploitation in the next 30 days. Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a…
CVE-2016-2518, published 2017-01-30. Medium severity, CVSS 5.3. EPSS: 15.1% chance of exploitation in the next 30 days. The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.
CVE-2016-6667, published 2017-02-07. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. NetApp OnCommand Unified Manager for Clustered Data ONTAP 6.3 through 6.4P1 contain a default privileged account, which allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2017-14053, published 2017-09-01. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. NetApp OnCommand Unified Manager for Clustered Data ONTAP before 7.2P1 does not set the secure flag for an unspecified cookie in an HTTPS session, which makes it easier for remote attackers to…