Netapp Ontap Select Deploy Administration Utility vulnerabilities

179 CVEs affecting Netapp Ontap Select Deploy Administration Utility, 4 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-1181, published 2025-02-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-3156: Sudo Heap-Based Buffer Overflow Vulnerability, published 2021-01-26. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-06. EPSS: 100% chance of exploitation in the next 30 days. Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends…
CVE-2016-5195: Linux Kernel Race Condition Vulnerability, published 2016-11-10. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 83.5% chance of exploitation in the next 30 days. Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a…
CVE-2020-15999: Google Chrome FreeType Heap Buffer Overflow Vulnerability, published 2020-11-03. Critical severity, CVSS 9.6. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 63.9% chance of exploitation in the next 30 days. Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2023-4911: GNU C Library Buffer Overflow Vulnerability, published 2023-10-03. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-11-21. EPSS: 63.8% chance of exploitation in the next 30 days. A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously…
CVE-2024-6387, published 2024-07-01. High severity, CVSS 8.1. EPSS: 99.5% chance of exploitation in the next 30 days. A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote…
CVE-2022-2068, published 2022-06-21. High severity, CVSS 7.3. EPSS: 96.4% chance of exploitation in the next 30 days. In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command…
CVE-2023-25136, published 2023-02-03. Medium severity, CVSS 6.5. EPSS: 89.7% chance of exploitation in the next 30 days. OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote…
CVE-2024-2961, published 2024-04-17. High severity, CVSS 7.3. EPSS: 88.3% chance of exploitation in the next 30 days. The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may…
CVE-2024-6119, published 2024-09-03. High severity, CVSS 7.5. EPSS: 66.6% chance of exploitation in the next 30 days. Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the…
CVE-2021-3449, published 2021-03-25. Medium severity, CVSS 5.9. EPSS: 63.5% chance of exploitation in the next 30 days. An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where…

Latest

CVE-2025-1181, published 2025-02-11. Medium severity, CVSS 5.0. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c of the component ld. The manipulation…
CVE-2025-1178, published 2025-02-11. Medium severity, CVSS 5.6. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libbfd.c of the component ld. The…
CVE-2025-0167, published 2025-02-05. Low severity, CVSS 3.4. EPSS: 0.7% chance of exploitation in the next 30 days. When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This…
CVE-2024-11053, published 2024-12-11. Low severity, CVSS 3.4. EPSS: 2% chance of exploitation in the next 30 days. When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This…
CVE-2024-8096, published 2024-09-11. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems…
CVE-2024-39689, published 2024-07-05. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to…
CVE-2024-21990, published 2024-04-17. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deploy configuration information and modify…
CVE-2024-21989, published 2024-04-17. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x are susceptible to a vulnerability which when successfully exploited could allow a read-only user to escalate…