Netapp Santricity Cloud Connector vulnerabilities

27 CVEs affecting Netapp Santricity Cloud Connector, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-34428, published 2021-06-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-15715, published 2018-03-26. High severity, CVSS 8.1. EPSS: 85.5% chance of exploitation in the next 30 days. In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could…
CVE-2021-28164, published 2021-04-01. Medium severity, CVSS 5.3. EPSS: 82.4% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF…
CVE-2018-1303, published 2018-03-26. High severity, CVSS 7.5. EPSS: 69.8% chance of exploitation in the next 30 days. A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be…
CVE-2021-28165, published 2021-04-01. High severity, CVSS 7.5. EPSS: 53.9% chance of exploitation in the next 30 days. In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVE-2018-17199, published 2019-01-30. High severity, CVSS 7.5. EPSS: 20.2% chance of exploitation in the next 30 days. In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie…
CVE-2018-17189, published 2019-01-30. Medium severity, CVSS 5.3. EPSS: 20.1% chance of exploitation in the next 30 days. In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up…
CVE-2017-7658, published 2018-06-26. Critical severity, CVSS 9.8. EPSS: 19.4% chance of exploitation in the next 30 days. In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the…
CVE-2017-15710, published 2018-03-26. High severity, CVSS 7.5. EPSS: 17.1% chance of exploitation in the next 30 days. In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset…
CVE-2018-1301, published 2018-03-26. Medium severity, CVSS 5.9. EPSS: 15% chance of exploitation in the next 30 days. A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This…
CVE-2017-7657, published 2018-06-26. Critical severity, CVSS 9.8. EPSS: 14.9% chance of exploitation in the next 30 days. In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk…

Latest

CVE-2021-34428, published 2021-06-22. Low severity, CVSS 3.5. EPSS: 1% chance of exploitation in the next 30 days. For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID…
CVE-2021-28163, published 2021-04-01. Low severity, CVSS 2.7. EPSS: 4.2% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a…
CVE-2020-14803, published 2020-10-21. Medium severity, CVSS 5.3. EPSS: 3.2% chance of exploitation in the next 30 days. Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated…
CVE-2020-14798, published 2020-10-21. Low severity, CVSS 3.1. EPSS: 2.7% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded:…
CVE-2020-14797, published 2020-10-21. Low severity, CVSS 3.7. EPSS: 2.2% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded:…
CVE-2020-14796, published 2020-10-21. Low severity, CVSS 3.1. EPSS: 2.5% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded:…
CVE-2020-14792, published 2020-10-21. Medium severity, CVSS 4.2. EPSS: 2.2% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261.…
CVE-2020-14781, published 2020-10-21. Low severity, CVSS 3.7. EPSS: 2.3% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261.…