Netapp Solidfire vulnerabilities

192 CVEs affecting Netapp Solidfire, 5 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-32487, published 2024-04-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-3156: Sudo Heap-Based Buffer Overflow Vulnerability, published 2021-01-26. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-06. EPSS: 100% chance of exploitation in the next 30 days. Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends…
CVE-2016-5195: Linux Kernel Race Condition Vulnerability, published 2016-11-10. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 83.5% chance of exploitation in the next 30 days. Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a…
CVE-2021-22555: Linux Kernel Heap Out-of-Bounds Write Vulnerability, published 2021-07-07. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2025-10-06. EPSS: 78.7% chance of exploitation in the next 30 days. A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through…
CVE-2019-2215: Android Kernel Use-After-Free Vulnerability, published 2019-10-11. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 72.1% chance of exploitation in the next 30 days. A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require…
CVE-2019-13272: Linux Kernel Improper Privilege Management Vulnerability, published 2019-07-17. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 52.2% chance of exploitation in the next 30 days. In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to…
CVE-2021-34429, published 2021-07-15. Medium severity, CVSS 5.3. EPSS: 99.3% chance of exploitation in the next 30 days. For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security…
CVE-2019-5736, published 2019-02-11. High severity, CVSS 8.6. EPSS: 98.5% chance of exploitation in the next 30 days. runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to…
CVE-2022-2068, published 2022-06-21. High severity, CVSS 7.3. EPSS: 96.4% chance of exploitation in the next 30 days. In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command…
CVE-2017-5753, published 2018-01-04. Medium severity, CVSS 5.6. EPSS: 93.8% chance of exploitation in the next 30 days. Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
CVE-2021-3711, published 2021-08-24. Critical severity, CVSS 9.8. EPSS: 87.8% chance of exploitation in the next 30 days. In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the…

Latest

CVE-2024-32487, published 2024-04-13. High severity, CVSS 8.6. EPSS: 0.6% chance of exploitation in the next 30 days. less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled…
CVE-2023-38432, published 2023-07-18. Critical severity, CVSS 9.1. EPSS: 2.5% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification,…
CVE-2022-35252, published 2022-09-23. Low severity, CVSS 3.7. EPSS: 3.8% chance of exploitation in the next 30 days. When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses.…
CVE-2022-21549, published 2022-07-19. Medium severity, CVSS 5.3. EPSS: 2.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle…
CVE-2022-21541, published 2022-07-19. Medium severity, CVSS 5.9. EPSS: 2.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333,…
CVE-2022-21540, published 2022-07-19. Medium severity, CVSS 5.3. EPSS: 4.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333,…
CVE-2022-34169, published 2022-07-19. High severity, CVSS 7.5. EPSS: 81.8% chance of exploitation in the next 30 days. The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal…
CVE-2022-32208, published 2022-07-07. Medium severity, CVSS 5.9. EPSS: 8.4% chance of exploitation in the next 30 days. When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it…
CVE-2022-32207, published 2022-07-07. Critical severity, CVSS 9.8. EPSS: 12.3% chance of exploitation in the next 30 days. When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In…
CVE-2022-32206, published 2022-07-07. Medium severity, CVSS 6.5. EPSS: 36.3% chance of exploitation in the next 30 days. curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable…