Netapp - Oncommand Unified Manager Core Package CVE

Filtered by vendor Netapp Subscribe

Filtered by product Oncommand Unified Manager Core Package

Total 11 CVE

CVE	Vendors	Products	Updated	CVSS v2	CVSS v3
CVE-2021-3156	8 Beyondtrust, Debian, Fedoraproject and 5 more	31 Privilege Management For Mac, Privilege Management For Unix\/linux, Debian Linux and 28 more	2024-11-21	7.2 HIGH	7.8 HIGH
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
CVE-2021-23926	4 Apache, Debian, Netapp and 1 more	7 Xmlbeans, Debian Linux, Oncommand Unified Manager Core Package and 4 more	2024-11-21	6.4 MEDIUM	9.1 CRITICAL
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
CVE-2020-1927	8 Apache, Broadcom, Canonical and 5 more	14 Http Server, Brocade Fabric Operating System, Ubuntu Linux and 11 more	2024-11-21	5.8 MEDIUM	6.1 MEDIUM
In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.
CVE-2020-14779	5 Debian, Fedoraproject, Netapp and 2 more	18 Debian Linux, Fedora, 7-mode Transition Tool and 15 more	2024-11-21	4.3 MEDIUM	3.7 LOW
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2020-14621	7 Canonical, Debian, Fedoraproject and 4 more	22 Ubuntu Linux, Debian Linux, Fedora and 19 more	2024-11-21	5.0 MEDIUM	5.3 MEDIUM
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2020-14002	3 Fedoraproject, Netapp, Putty	3 Fedora, Oncommand Unified Manager Core Package, Putty	2024-11-21	4.3 MEDIUM	5.9 MEDIUM
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
CVE-2019-1559	13 Canonical, Debian, F5 and 10 more	90 Ubuntu Linux, Debian Linux, Big-ip Access Policy Manager and 87 more	2024-11-21	4.3 MEDIUM	5.9 MEDIUM
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
CVE-2019-17069	3 Netapp, Opensuse, Putty	3 Oncommand Unified Manager Core Package, Leap, Putty	2024-11-21	5.0 MEDIUM	7.5 HIGH
PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.
CVE-2017-7439	1 Netapp	1 Oncommand Unified Manager Core Package	2024-11-21	5.0 MEDIUM	7.5 HIGH
NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors involving error messages.
CVE-2017-7236	1 Netapp	1 Oncommand Unified Manager Core Package	2024-11-21	5.0 MEDIUM	7.5 HIGH
SQL injection vulnerability in NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2017-15906	5 Debian, Netapp, Openbsd and 2 more	22 Debian Linux, Active Iq Unified Manager, Cloud Backup and 19 more	2024-11-21	5.0 MEDIUM	5.3 MEDIUM
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.

Vulnerabilities (CVE)