Oracle ZFS Storage Appliance vulnerabilities

12 CVEs affecting Oracle ZFS Storage Appliance, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-2149, published 2021-04-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-23336, published 2021-02-15. Medium severity, CVSS 5.9. EPSS: 40.7% chance of exploitation in the next 30 days. The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via…
CVE-2019-16168, published 2019-09-09. Medium severity, CVSS 6.5. EPSS: 4.3% chance of exploitation in the next 30 days. In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the…
CVE-2019-19553, published 2019-12-05. High severity, CVSS 7.5. EPSS: 4.1% chance of exploitation in the next 30 days. In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/asn1/cms/packet-cms-template.c by ensuring that an object identifier is set to…
CVE-2021-22191, published 2021-03-15. High severity, CVSS 8.8. EPSS: 3.7% chance of exploitation in the next 30 days. Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted capture file.
CVE-2021-28041, published 2021-03-05. High severity, CVSS 7.1. EPSS: 3.5% chance of exploitation in the next 30 days. ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an…
CVE-2021-22174, published 2021-02-17. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file
CVE-2021-22173, published 2021-02-17. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. Memory leak in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file
CVE-2021-1993, published 2021-01-20. Medium severity, CVSS 4.8. EPSS: 0.8% chance of exploitation in the next 30 days. Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged…
CVE-2018-1165, published 2018-02-21. High severity, CVSS 7.0. EPSS: 0.5% chance of exploitation in the next 30 days. This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute…
CVE-2021-1999, published 2021-01-20. Medium severity, CVSS 5.0. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: RAS subsystems). The supported version that is affected is 8.8. Difficult to exploit vulnerability allows…

Latest

CVE-2021-2149, published 2021-04-22. Low severity, CVSS 2.5. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Difficult to exploit vulnerability allows low…
CVE-2021-2147, published 2021-04-22. Low severity, CVSS 1.8. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Installation). The supported version that is affected is 8.8. Difficult to exploit vulnerability allows…