Netapp Snapmanager vulnerabilities

180 CVEs affecting Netapp Snapmanager, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-40304, published 2022-11-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-39144: XStream Remote Code Execution Vulnerability, published 2021-08-23. High severity, CVSS 8.5. Actively exploited: in CISA KEV since 2023-03-10. EPSS: 98.1% chance of exploitation in the next 30 days. XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only…
CVE-2022-2068, published 2022-06-21. High severity, CVSS 7.3. EPSS: 96.4% chance of exploitation in the next 30 days. In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command…
CVE-2020-26217, published 2020-11-16. High severity, CVSS 8.8. EPSS: 85% chance of exploitation in the next 30 days. XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.…
CVE-2022-1292, published 2022-05-03. High severity, CVSS 7.3. EPSS: 82.6% chance of exploitation in the next 30 days. The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed.…
CVE-2020-27223, published 2021-02-26. Medium severity, CVSS 5.3. EPSS: 78% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q)…
CVE-2021-29505, published 2021-05-28. High severity, CVSS 8.8. EPSS: 77.2% chance of exploitation in the next 30 days. XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of…
CVE-2022-23305, published 2022-01-18. Critical severity, CVSS 9.8. EPSS: 66.5% chance of exploitation in the next 30 days. By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is…
CVE-2022-23302, published 2022-01-18. High severity, CVSS 8.8. EPSS: 63.6% chance of exploitation in the next 30 days. JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP…
CVE-2022-40303, published 2022-11-23. High severity, CVSS 7.5. EPSS: 41.4% chance of exploitation in the next 30 days. An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an…
CVE-2017-7658, published 2018-06-26. Critical severity, CVSS 9.8. EPSS: 19.4% chance of exploitation in the next 30 days. In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the…

Latest

CVE-2022-40304, published 2022-11-23. High severity, CVSS 7.8. EPSS: 5.8% chance of exploitation in the next 30 days. An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can…
CVE-2022-1473, published 2022-05-03. High severity, CVSS 7.5. EPSS: 4.6% chance of exploitation in the next 30 days. The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding…
CVE-2022-1434, published 2022-05-03. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by…
CVE-2022-1343, published 2022-05-03. Medium severity, CVSS 5.3. EPSS: 2.1% chance of exploitation in the next 30 days. The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a…
CVE-2022-29824, published 2022-05-03. Medium severity, CVSS 6.5. EPSS: 3.8% chance of exploitation in the next 30 days. In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation…
CVE-2022-22968, published 2022-04-14. Medium severity, CVSS 5.3. EPSS: 5.7% chance of exploitation in the next 30 days. In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not…
CVE-2022-23308, published 2022-02-26. High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days. valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.