Netapp Solidfire Baseboard Management Controller Firmware vulnerabilities

71 CVEs affecting Netapp Solidfire Baseboard Management Controller Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-42252, published 2021-10-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-2215: Android Kernel Use-After-Free Vulnerability, published 2019-10-11. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 72.1% chance of exploitation in the next 30 days. A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require…
CVE-2021-22901, published 2021-06-11. High severity, CVSS 8.1. EPSS: 63.5% chance of exploitation in the next 30 days. curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use…
CVE-2019-5481, published 2019-09-16. Critical severity, CVSS 9.8. EPSS: 7.5% chance of exploitation in the next 30 days. Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
CVE-2021-22945, published 2021-09-23. Critical severity, CVSS 9.1. EPSS: 6.7% chance of exploitation in the next 30 days. When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call…
CVE-2021-22924, published 2021-08-05. Low severity, CVSS 3.7. EPSS: 6.3% chance of exploitation in the next 30 days. libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take…
CVE-2019-19052, published 2019-11-18. High severity, CVSS 7.5. EPSS: 5.2% chance of exploitation in the next 30 days. A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering…
CVE-2020-13143, published 2020-05-18. Medium severity, CVSS 6.5. EPSS: 5.2% chance of exploitation in the next 30 days. gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows…
CVE-2020-14305, published 2020-12-02. High severity, CVSS 8.1. EPSS: 5.2% chance of exploitation in the next 30 days. An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated…
CVE-2021-22946, published 2021-09-29. High severity, CVSS 7.5. EPSS: 4.5% chance of exploitation in the next 30 days. A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to…
CVE-2021-22897, published 2021-06-11. Medium severity, CVSS 5.3. EPSS: 4.3% chance of exploitation in the next 30 days. curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The…

Latest

CVE-2021-42252, published 2021-10-11. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could…
CVE-2021-42008, published 2021-10-05. High severity, CVSS 7.8. EPSS: 1.6% chance of exploitation in the next 30 days. The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root…
CVE-2021-41864, published 2021-10-02. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds…
CVE-2021-22947, published 2021-09-29. Medium severity, CVSS 5.9. EPSS: 3% chance of exploitation in the next 30 days. When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that…
CVE-2021-3612, published 2021-07-09. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user…