Netapp Ontap 9 vulnerabilities

7 CVEs affecting Netapp Ontap 9, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-53580, published 2024-12-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability, published 2024-07-01. Critical severity, CVSS 9.1. Actively exploited: in CISA KEV since 2025-05-01. EPSS: 100% chance of exploitation in the next 30 days. Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not…
CVE-2024-6119, published 2024-09-03. High severity, CVSS 7.5. EPSS: 66.6% chance of exploitation in the next 30 days. Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the…
CVE-2022-42915, published 2022-10-29. High severity, CVSS 8.1. EPSS: 2.9% chance of exploitation in the next 30 days. curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the…
CVE-2023-27535, published 2023-03-30. Medium severity, CVSS 5.9. EPSS: 1.8% chance of exploitation in the next 30 days. An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created…
CVE-2024-26461, published 2024-02-29. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
CVE-2024-53580, published 2024-12-18. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function.
CVE-2024-26458, published 2024-02-29. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.