Netapp Snapdrive vulnerabilities

18 CVEs affecting Netapp Snapdrive, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-29824, published 2022-05-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-8610, published 2017-11-13. High severity, CVSS 7.5. EPSS: 39.7% chance of exploitation in the next 30 days. A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote…
CVE-2021-3518, published 2021-05-18. High severity, CVSS 8.8. EPSS: 21.9% chance of exploitation in the next 30 days. There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The…
CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
CVE-2021-3517, published 2021-05-19. High severity, CVSS 8.6. EPSS: 17% chance of exploitation in the next 30 days. There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the…
CVE-2018-18312, published 2018-12-05. Critical severity, CVSS 9.8. EPSS: 12.8% chance of exploitation in the next 30 days. Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.
CVE-2018-18313, published 2018-12-07. Critical severity, CVSS 9.1. EPSS: 9.5% chance of exploitation in the next 30 days. Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.
CVE-2020-7595, published 2020-01-21. High severity, CVSS 7.5. EPSS: 7.8% chance of exploitation in the next 30 days. xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
CVE-2018-12015, published 2018-06-07. High severity, CVSS 7.5. EPSS: 7.3% chance of exploitation in the next 30 days. In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink…
CVE-2018-18314, published 2018-12-07. Critical severity, CVSS 9.8. EPSS: 6.1% chance of exploitation in the next 30 days. Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.
CVE-2022-23308, published 2022-02-26. High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days. valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

Latest

CVE-2022-29824, published 2022-05-03. Medium severity, CVSS 6.5. EPSS: 3.8% chance of exploitation in the next 30 days. In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation…
CVE-2021-3541, published 2021-07-09. Medium severity, CVSS 6.5. EPSS: 2.1% chance of exploitation in the next 30 days. A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
CVE-2021-3537, published 2021-05-14. Medium severity, CVSS 5.9. EPSS: 3.6% chance of exploitation in the next 30 days. A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed…
CVE-2020-24977, published 2020-09-04. Medium severity, CVSS 6.5. EPSS: 3% chance of exploitation in the next 30 days. GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.
CVE-2019-20388, published 2020-01-21. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.