Netapp Vasa Provider For Clustered Data Ontap vulnerabilities

69 CVEs affecting Netapp Vasa Provider For Clustered Data Ontap, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-28165, published 2021-04-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-3427: Oracle Java SE and JRockit Unspecified Vulnerability, published 2016-04-21. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 92.3% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2021-28164, published 2021-04-01. Medium severity, CVSS 5.3. EPSS: 82.4% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF…
CVE-2021-28165, published 2021-04-01. High severity, CVSS 7.5. EPSS: 53.9% chance of exploitation in the next 30 days. In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVE-2020-13954, published 2020-11-12. Medium severity, CVSS 6.1. EPSS: 40.9% chance of exploitation in the next 30 days. By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the…
CVE-2017-10355, published 2017-10-19. Medium severity, CVSS 5.3. EPSS: 16.2% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE…
CVE-2017-10309, published 2017-10-19. High severity, CVSS 7.1. EPSS: 8.8% chance of exploitation in the next 30 days. Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 8u144 and 9. Easily exploitable vulnerability allows…
CVE-2016-9841, published 2017-05-23. Critical severity, CVSS 9.8. EPSS: 7.6% chance of exploitation in the next 30 days. inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
CVE-2019-10247, published 2019-04-22. Medium severity, CVSS 5.3. EPSS: 5.9% chance of exploitation in the next 30 days. In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified…
CVE-2018-20836, published 2019-05-07. High severity, CVSS 8.1. EPSS: 5.1% chance of exploitation in the next 30 days. An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free.
CVE-2017-10176, published 2017-08-08. High severity, CVSS 7.5. EPSS: 5% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded:…

Latest

CVE-2021-28163, published 2021-04-01. Low severity, CVSS 2.7. EPSS: 4.2% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a…
CVE-2020-11868, published 2020-04-17. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because…
CVE-2019-11815, published 2019-05-08. High severity, CVSS 8.1. EPSS: 4.4% chance of exploitation in the next 30 days. An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cleanup.
CVE-2019-3900, published 2019-04-25. High severity, CVSS 7.7. EPSS: 4.3% chance of exploitation in the next 30 days. An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets…
CVE-2019-3882, published 2019-04-24. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local…
CVE-2019-11486, published 2019-04-23. High severity, CVSS 7.0. EPSS: 0.4% chance of exploitation in the next 30 days. The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions.