Netapp
Netapp Solidfire Baseboard Management Controller Firmware: vulnerabilidades y CVE
Netapp Solidfire Baseboard Management Controller Firmware tiene 71 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 3 son críticas y 1 figuran en el catálogo de explotación activa de CISA.
CVE71
Últimos 12 meses0
Críticas3
Explotadas activamente1
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2019-2215 | Alta (7.8) | 72% | ⚠ Explotación activa | 11 oct 2019 | A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2021-42252 | Alta (7.8) | 0.37% | — | 11 oct 2021 | An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the… |
| CVE-2021-42008 | Alta (7.8) | 1.6% | — | 5 oct 2021 | The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access. |
| CVE-2021-41864 | Alta (7.8) | 0.41% | — | 2 oct 2021 | prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write. |
| CVE-2021-22947 | Media (5.9) | 3.0% | — | 29 sept 2021 | When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl… |
| CVE-2021-22946 | Alta (7.5) | 4.5% | — | 29 sept 2021 | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or… |
| CVE-2021-22945 | Crítica (9.1) | 6.7% | — | 23 sept 2021 | When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also… |
| CVE-2021-22924 | Baja (3.7) | 6.3% | — | 5 ago 2021 | libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into… |
| CVE-2021-3612 | Alta (7.8) | 0.69% | — | 9 jul 2021 | An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system… |
| CVE-2021-22901 | Alta (8.1) | 60% | — | 11 jun 2021 | curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare… |
| CVE-2021-22897 | Media (5.3) | 3.0% | — | 11 jun 2021 | curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set… |
| CVE-2019-25045 | Alta (7.8) | 0.50% | — | 7 jun 2021 | An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free, related to an xfrm_state_fini panic, aka CID-dbb2483b2a46. |
| CVE-2020-25668 | Alta (7) | 1.0% | — | 26 may 2021 | A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op. |
| CVE-2021-22543 | Alta (8.7) | 0.66% | — | 26 may 2021 | An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with… |
| CVE-2020-25673 | Media (5.5) | 0.47% | — | 26 may 2021 | A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak and eventually hanging-up the system. |
| CVE-2020-25671 | Alta (7.8) | 0.51% | — | 26 may 2021 | A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-free which might lead to privilege escalations. |
| CVE-2020-25670 | Alta (7.8) | 0.59% | — | 26 may 2021 | A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free which might lead to privilege escalations. |
| CVE-2021-33574 | Crítica (9.8) | 2.9% | — | 25 may 2021 | The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been… |
| CVE-2020-25672 | Alta (7.5) | 3.1% | — | 25 may 2021 | A memory leak vulnerability was found in Linux kernel in llcp_sock_connect |
| CVE-2021-31440 | Alta (7) | 1.8% | — | 21 may 2021 | This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order… |
| CVE-2019-25044 | Alta (7.8) | 0.65% | — | 14 may 2021 | The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs… |
| CVE-2021-23134 | Alta (7.8) | 0.38% | — | 12 may 2021 | Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user… |
| CVE-2021-32399 | Alta (7) | 0.69% | — | 10 may 2021 | net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller. |
| CVE-2020-35519 | Alta (7.8) | 0.41% | — | 6 may 2021 | An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access… |
| CVE-2021-3501 | Alta (7.1) | 0.38% | — | 6 may 2021 | A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an… |
| CVE-2021-23133 | Alta (7) | 0.47% | — | 22 abr 2021 | A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called… |
| CVE-2021-3506 | Alta (7.1) | 0.37% | — | 19 abr 2021 | An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds… |
| CVE-2021-28972 | Media (6.7) | 0.80% | — | 22 mar 2021 | In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace… |
| CVE-2021-28971 | Media (5.5) | 0.39% | — | 22 mar 2021 | In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS status in a PEBS… |
| CVE-2021-28964 | Media (4.7) | 0.27% | — | 22 mar 2021 | A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a… |
| CVE-2021-28952 | Alta (7.8) | 0.38% | — | 20 mar 2021 | An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device driver has a buffer overflow when an unexpected port ID number is encountered, aka CID-1c668e1c0a0f. (This has… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.
Otros productos de Netapp
Oncommand Insight · 971Active IQ Unified Manager · 848Oncommand Workflow Automation · 743Snapcenter · 575Cloud Backup · 349H700s Firmware · 293H300s Firmware · 292H410s Firmware · 292H500s Firmware · 292E-series Santricity OS Controller · 242H410c Firmware · 240Steelstore Cloud Integrated Storage · 211