Netapp Service Processor vulnerabilities

13 CVEs affecting Netapp Service Processor, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-25013, published 2021-01-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-2215: Android Kernel Use-After-Free Vulnerability, published 2019-10-11. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 72.1% chance of exploitation in the next 30 days. A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require…
CVE-2019-13272: Linux Kernel Improper Privilege Management Vulnerability, published 2019-07-17. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 52.2% chance of exploitation in the next 30 days. In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to…
CVE-2018-15473, published 2018-08-17. Medium severity, CVSS 5.3. EPSS: 98.6% chance of exploitation in the next 30 days. OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed,…
CVE-2016-8610, published 2017-11-13. High severity, CVSS 7.5. EPSS: 39.7% chance of exploitation in the next 30 days. A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote…
CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
CVE-2016-10708, published 2018-01-21. High severity, CVSS 7.5. EPSS: 15.7% chance of exploitation in the next 30 days. sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz,…
CVE-2019-25013, published 2021-01-04. Medium severity, CVSS 5.9. EPSS: 3.6% chance of exploitation in the next 30 days. The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.
CVE-2019-16995, published 2019-09-30. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. In the Linux kernel before 5.0.3, a memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c if hsr_add_port fails to add a port, which may cause denial of service, aka CID-6caabe7f197d.
CVE-2019-5490, published 2019-03-21. Critical severity, CVSS 9.8. EPSS: 3.5% chance of exploitation in the next 30 days. Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled that could allow unauthorized arbitrary command execution.…
CVE-2019-14816, published 2019-09-20. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash)…

Latest

CVE-2019-14814, published 2019-09-20. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system…
CVE-2019-14835, published 2019-09-17. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during…
CVE-2019-15902, published 2019-09-04. Medium severity, CVSS 5.6. EPSS: 0.6% chance of exploitation in the next 30 days. A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x through 4.9.190, 4.14.x through 4.14.141, 4.19.x through 4.19.69, and 5.2.x through 5.2.11. Misuse…