Netapp Storage Automation Store vulnerabilities

113 CVEs affecting Netapp Storage Automation Store, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-11035, published 2019-04-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-10933, published 2018-10-17. Critical severity, CVSS 9.1. EPSS: 91.8% chance of exploitation in the next 30 days. A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in…
CVE-2017-5645, published 2017-04-17. Critical severity, CVSS 9.8. EPSS: 89.8% chance of exploitation in the next 30 days. In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
CVE-2017-15715, published 2018-03-26. High severity, CVSS 8.1. EPSS: 85.5% chance of exploitation in the next 30 days. In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could…
CVE-2019-0192, published 2019-03-07. Critical severity, CVSS 9.8. EPSS: 78.2% chance of exploitation in the next 30 days. In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take…
CVE-2019-6977, published 2019-01-27. High severity, CVSS 8.8. EPSS: 71.5% chance of exploitation in the next 30 days. gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x…
CVE-2018-1303, published 2018-03-26. High severity, CVSS 7.5. EPSS: 69.8% chance of exploitation in the next 30 days. A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be…
CVE-2017-9788, published 2017-07-13. Critical severity, CVSS 9.1. EPSS: 56.8% chance of exploitation in the next 30 days. In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value…
CVE-2018-11763, published 2018-09-25. Medium severity, CVSS 5.9. EPSS: 50.8% chance of exploitation in the next 30 days. In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This…
CVE-2017-16642, published 2017-11-07. High severity, CVSS 7.5. EPSS: 26.4% chance of exploitation in the next 30 days. In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' and 'back of' directives could be used by attackers able to…
CVE-2019-6110, published 2019-01-31. Medium severity, CVSS 6.8. EPSS: 24.9% chance of exploitation in the next 30 days. In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI…

Latest

CVE-2019-11035, published 2019-04-18. Critical severity, CVSS 9.1. EPSS: 4.4% chance of exploitation in the next 30 days. When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function.…
CVE-2019-11034, published 2019-04-18. Critical severity, CVSS 9.1. EPSS: 4.1% chance of exploitation in the next 30 days. When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG…
CVE-2019-9641, published 2019-03-09. Critical severity, CVSS 9.8. EPSS: 9.4% chance of exploitation in the next 30 days. An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.
CVE-2019-9640, published 2019-03-09. High severity, CVSS 7.5. EPSS: 6.2% chance of exploitation in the next 30 days. An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn.
CVE-2019-9639, published 2019-03-09. High severity, CVSS 7.5. EPSS: 8.2% chance of exploitation in the next 30 days. An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling…
CVE-2019-9638, published 2019-03-09. High severity, CVSS 7.5. EPSS: 6.7% chance of exploitation in the next 30 days. An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling…
CVE-2019-9637, published 2019-03-09. High severity, CVSS 7.5. EPSS: 7.3% chance of exploitation in the next 30 days. An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly…
CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
CVE-2019-9025, published 2019-02-22. Critical severity, CVSS 9.8. EPSS: 3.1% chance of exploitation in the next 30 days. An issue was discovered in PHP 7.3.x before 7.3.1. An invalid multibyte string supplied as an argument to the mb_split() function in ext/mbstring/php_mbregex.c can cause PHP to execute memcpy() with…