CVE-2024-0567

Gnutls: rejects certificate chain with distributed trust

A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Debian Fedoraproject Gnu and 2 more

Products

Debian Linux Fedora Gnutls and 7 more

CVE-2024-0565

Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive_encrypted_standard of client

An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.

CVSS 3.1 · 6.8 Medium EPSS 2.0% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel Ontap Tools Enterprise Linux and 4 more

CVE-2024-1635

Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available. At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hence, the Undertow WriteTimeoutStreamSinkConduit is not notified of the closed connection in this scenario. Because WriteTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO WorkerThread. So, the workerThread points to the Undertow conduit, which contains the connections and causes the leak.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed

Vendors

Netapp Redhat

Products

Active Iq Unified Manager Oncommand Workflow Automation Amq Streams and 23 more

CVE-2026-22063

CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products

The private keys of eight eMudhra intermediate CA certificates have been compromised. eMudhra revoked the eight affected intermediate certificates on October 18, 2026. While this is not a software vulnerability, CVE-2026-22063 has been assigned to track relevant changes in impacted NetApp products.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Netapp

Products

E-series Santricity Os Controller Ontap 9 Storagegrid Webscale

CVE-2024-2961

glibc: Out of bounds write in iconv may lead to remote code execution

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

CVSS 3.1 · 7.3 High EPSS 88.3% KEV · Not listed

Vendors

Debian Gnu Netapp and 1 more

Products

Debian Linux Glibc Active Iq Unified Manager and 26 more

CVE-2022-2068

The c_rehash script allows command injection

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).

CVSS 3.1 · 9.8 Critical EPSS 96.4% KEV · Not listed

Vendors

Broadcom Debian Fedoraproject and 4 more

Products

Sannav Debian Linux Fedora and 46 more

CVE-2022-1292

The c_rehash script allows command injection

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

CVSS 3.1 · 9.8 Critical EPSS 82.6% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 4 more

Products

Debian Linux Fedora A250 and 55 more

CVE-2024-50379

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

CVSS 3.1 · 9.8 Critical EPSS 31.8% KEV · Not listed

Vendors

Apache Netapp Redhat

Products

Tomcat Bootstrap Os Hci Compute Node and 3 more

CVE-2024-38472

Apache HTTP Server on WIndows UNC SSRF

SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.

CVSS 3.1 · 7.5 High EPSS 69.5% KEV · Not listed

Vendors

Apache Apache Software Foundation Netapp and 1 more

Products

Http Server Apache Http Server Ontap and 1 more

CVE-2015-5477

bind: TKEY query handling flaw leading to denial of service

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

CVSS 3.1 · 7.5 High EPSS 99.6% KEV · Listed

Vendors

Apple Canonical Debian and 10 more

Products

Os X Server Ubuntu Linux Debian Linux and 76 more

CVE-2023-45862

kernel: drivers/usb/storage/ene_ub6250.c

An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel Active Iq Unified Manager H410c and 3 more

CVE-2023-27537

curl: HSTS double-free

A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

CVSS 3.1 · 5.9 Medium EPSS 1.9% KEV · Not listed

Vendors

Broadcom Haxx Netapp and 1 more

Products

Brocade Fabric Operating System Firmware Libcurl Active Iq Unified Manager and 10 more

CVE-2023-1077

kernel: Type confusion in pick_next_rt_entity()

In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Netapp and 1 more

Products

Debian Linux Linux Kernel 8300 and 20 more

CVE-2022-48564

python: DoS when processing malformed Apple Property List files in binary format

read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Netapp Python Redhat

Products

Active Iq Unified Manager Python Enterprise Linux and 1 more

CVE-2022-27779

curl: cookie for trailing dot TLD

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.

CVSS 3.1 · 5.3 Medium EPSS 2.8% KEV · Not listed

Vendors

Haxx Netapp Splunk

Products

Curl Clustered Data Ontap H300s and 12 more

CVE-2022-1354

libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c

A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Libtiff and 2 more

Products

Debian Linux Fedora Libtiff and 2 more

CVE-2021-4204

kernel: improper input validation may lead to privilege escalation

An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. This flaw allows a local attacker with a special privilege to crash the system or leak internal information.

CVSS 3.1 · 7.1 High EPSS 1.2% KEV · Not listed

Vendors

Debian Linux Netapp and 1 more

Products

Debian Linux Linux Kernel H300s and 12 more

CVE-2021-41184

XSS in the `of` option of the `.position()` util

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

CVSS 3.1 · 6.5 Medium EPSS 40.8% KEV · Not listed

Vendors

Drupal Fedoraproject Jqueryui and 4 more

Products

Drupal Fedora Jquery Ui and 33 more

CVE-2020-8908

Temp directory permission issue in Guava

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Google Netapp Oracle and 2 more

Products

Guava Active Iq Unified Manager Commerce Guided Search and 17 more

CVE-2020-11022

jQuery has a potential XSS vulnerability

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVSS 3.1 · 6.9 Medium EPSS 99.2% KEV · Not listed

Vendors

Debian Drupal Fedoraproject and 6 more

Products

Debian Linux Drupal Fedora and 85 more