Netapp Solidfire & Hci Storage Node vulnerabilities

26 CVEs affecting Netapp Solidfire & Hci Storage Node, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-0725, published 2025-02-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2023-5178, published 2023-11-01. High severity, CVSS 8.8. EPSS: 9.6% chance of exploitation in the next 30 days. A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious…
CVE-2022-36946, published 2022-07-27. High severity, CVSS 7.5. EPSS: 8.9% chance of exploitation in the next 30 days. nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a…
CVE-2018-20836, published 2019-05-07. High severity, CVSS 8.1. EPSS: 5.1% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free.
CVE-2022-27776, published 2022-06-02. Medium severity, CVSS 6.5. EPSS: 4.1% chance of exploitation in the next 30 days. A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
CVE-2022-27775, published 2022-06-02. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a…
CVE-2023-38428, published 2023-07-18. Critical severity, CVSS 9.1. EPSS: 3.2% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider the address of security buffer, leading…
CVE-2023-38426, published 2023-07-18. Critical severity, CVSS 9.1. EPSS: 3% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger than the tag length.
CVE-2022-2048, published 2022-07-07. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and…
CVE-2023-38432, published 2023-07-18. Critical severity, CVSS 9.1. EPSS: 2.5% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification,…

Latest

CVE-2025-0725, published 2025-02-05. High severity, CVSS 7.3. EPSS: 1.8% chance of exploitation in the next 30 days. When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled…
CVE-2025-0167, published 2025-02-05. Low severity, CVSS 3.4. EPSS: 0.7% chance of exploitation in the next 30 days. When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This…
CVE-2024-40896, published 2024-12-23. Critical severity, CVSS 9.1. EPSS: 1.2% chance of exploitation in the next 30 days. In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by…
CVE-2024-50602, published 2024-10-27. Medium severity, CVSS 5.9. EPSS: 1.1% chance of exploitation in the next 30 days. An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.
CVE-2024-36958, published 2024-05-30. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix nfsd4_encode_fattr4() crasher Ensure that args.acl is initialized early. It is used in an unconditional call to kfree()…
CVE-2024-33602, published 2024-05-06. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the…
CVE-2023-37920, published 2023-07-25. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes…
CVE-2023-32257, published 2023-07-24. High severity, CVSS 8.1. EPSS: 2.4% chance of exploitation in the next 30 days. A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results…