Netapp
Netapp E-series Performance Analyzer: vulnerabilidades y CVE
Netapp E-series Performance Analyzer tiene 61 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 3 son críticas y 1 figuran en el catálogo de explotación activa de CISA.
CVE61
Últimos 12 meses0
Críticas3
Explotadas activamente1
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2019-13272 | Alta (7.8) | 52% | ⚠ Explotación activa | 17 jul 2019 | In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2022-23491 | Alta (7.5) | 0.51% | — | 7 dic 2022 | Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from… |
| CVE-2022-45061 | Alta (7.5) | 2.7% | — | 9 nov 2022 | An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being… |
| CVE-2022-31123 | Alta (7.8) | 0.27% | — | 13 oct 2022 | Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to… |
| CVE-2021-3999 | Alta (7.8) | 0.75% | — | 24 ago 2022 | A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size… |
| CVE-2022-31107 | Alta (7.5) | 2.9% | — | 15 jul 2022 | Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a… |
| CVE-2022-31097 | Alta (8.7) | 70% | — | 15 jul 2022 | Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting… |
| CVE-2022-21713 | Media (4.3) | 1.2% | — | 8 feb 2022 | Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an… |
| CVE-2022-21703 | Alta (8.8) | 2.3% | — | 8 feb 2022 | Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting… |
| CVE-2022-21702 | Media (5.4) | 2.3% | — | 8 feb 2022 | Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a… |
| CVE-2021-4044 | Alta (7.5) | 50% | — | 14 dic 2021 | Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of… |
| CVE-2021-26707 | Crítica (9.8) | 1.9% | — | 2 jun 2021 | The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus… |
| CVE-2021-33587 | Alta (7.5) | 2.3% | — | 28 may 2021 | The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input. |
| CVE-2021-33623 | Alta (7.5) | 2.9% | — | 28 may 2021 | The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method. |
| CVE-2021-32640 | Media (5.3) | 2.8% | — | 25 may 2021 | ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed… |
| CVE-2021-23383 | Crítica (9.8) | 4.5% | — | 4 may 2021 | The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source. |
| CVE-2021-28165 | Alta (7.5) | 54% | — | 1 abr 2021 | In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame. |
| CVE-2021-28164 | Media (5.3) | 82% | — | 1 abr 2021 | In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a… |
| CVE-2021-28163 | Baja (2.7) | 4.2% | — | 1 abr 2021 | In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp,… |
| CVE-2021-3449 | Media (5.9) | 64% | — | 25 mar 2021 | An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the… |
| CVE-2021-21267 | Alta (7.5) | 2.1% | — | 19 mar 2021 | Schema-Inspector is an open-source tool to sanitize and validate JS objects (npm package schema-inspector). In before version 2.0.0, email address validation is vulnerable to a denial-of-service attack where some input… |
| CVE-2021-27358 | Alta (7.5) | 83% | — | 18 mar 2021 | The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set. |
| CVE-2021-20231 | Crítica (9.8) | 3.8% | — | 12 mar 2021 | A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences. |
| CVE-2021-22884 | Alta (7.5) | 32% | — | 3 mar 2021 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is… |
| CVE-2021-22883 | Alta (7.5) | 74% | — | 3 mar 2021 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If… |
| CVE-2021-27219 | Alta (7.5) | 3.0% | — | 15 feb 2021 | An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could… |
| CVE-2021-27218 | Alta (7.5) | 4.1% | — | 15 feb 2021 | An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing… |
| CVE-2020-14782 | Baja (3.7) | 2.3% | — | 21 oct 2020 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to… |
| CVE-2020-11110 | Media (5.4) | 9.6% | — | 27 jul 2020 | Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard… |
| CVE-2020-14664 | Alta (8.3) | 4.2% | — | 15 jul 2020 | Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX). The supported version that is affected is Java SE: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network… |
| CVE-2020-14621 | Media (5.3) | 4.3% | — | 15 jul 2020 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.
Otros productos de Netapp
Oncommand Insight · 971Active IQ Unified Manager · 848Oncommand Workflow Automation · 743Snapcenter · 575Cloud Backup · 349H700s Firmware · 294H300s Firmware · 293H410s Firmware · 293H500s Firmware · 293E-series Santricity OS Controller · 242H410c Firmware · 241Steelstore Cloud Integrated Storage · 211