Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,536

Export CSV
CVE-2023-2124

kernel: OOB access in the Linux kernel's XFS subsystem

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel H300s and 15 more
CVE-2023-2007

kernel: DPT I2O controller TOCTOU information disclosure vulnerability

The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp
Products
Debian Linux Linux Kernel H300s and 10 more
CVE-2023-28464

Kernel: double free in hci_conn_cleanup of the bluetooth subsystem

hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel H300s Firmware H410c Firmware and 4 more
CVE-2023-27319

CVE-2023-27319 Information Disclosure Vulnerability in ONTAP Mediator

ONTAP Mediator versions prior to 1.7 are susceptible to a vulnerability that can allow an unauthenticated attacker to enumerate URLs via REST API.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Netapp
Products
Ontap Mediator
CVE-2023-27318

Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)

StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.13 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploit could lead to a crash of the Local Distribution Router (LDR) service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Netapp
Products
Storagegrid
CVE-2023-27315

Information Disclosure Vulnerability in SnapGathers

SnapGathers versions prior to 4.9 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext domain user credentials

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Netapp
Products
Snapgathers
CVE-2023-27314

Denial of Service Vulnerability in ONTAP 9

ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to cause a crash of the HTTP service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Netapp
Products
Clustered Data Ontap
CVE-2023-27313

Privilege Escalation Vulnerability in SnapCenter

SnapCenter versions 3.x and 4.x prior to 4.9 are susceptible to a vulnerability which may allow an authenticated unprivileged user to gain access as an admin user.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Netapp
Products
Snapcenter
CVE-2023-27312

Privilege Escalation Vulnerability in SnapCenter Plugin for VMware vSphere

SnapCenter Plugin for VMware vSphere versions 4.6 prior to 4.9 are susceptible to a vulnerability which may allow authenticated unprivileged users to modify email and snapshot name settings within the VMware vSphere user interface.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Netapp
Products
Snapcenter Plug-in
CVE-2023-22025

OpenJDK: memory corruption issue on x86_64 with AVX-512 (8317121)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u381-perf, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 21.3.7 and 22.3.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition,. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

CVSS 3.1 · 3.7 Low EPSS 1.0% KEV · Not listed
Vendors
Netapp Oracle Redhat
Products
Cloud Insights Acquisition Unit Cloud Insights Storage Workload Security Agent Graalvm For Jdk and 8 more
CVE-2023-21971

mysql-connector-java: Connector/J unspecified vulnerability (CPU April 2023)

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors as well as unauthorized update, insert or delete access to some of MySQL Connectors accessible data and unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H).

CVSS 3.1 · 5.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Netapp Oracle
Products
Active Iq Unified Manager Oncommand Insight Snapcenter and 3 more
CVE-2022-48502

kernel: ntfs3 subsystem does not properly check for correctness during disk reads

An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Linux Netapp
Products
Linux Kernel H300s H410c and 3 more
CVE-2022-48064

binutils: excessive memory consumption in _bfd_dwarf2_find_nearest_line_with_alt() in dwarf2.c

GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Gnu Netapp
Products
Fedora Binutils Ontap Select Deploy Administration Utility
CVE-2022-45919

kernel: use-after-free due to race condition occurring in dvb_ca_en50221.c

An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel H300s H300s Firmware and 11 more
CVE-2022-45886

kernel: use-after-free due to race condition occurring in dvb_net.c

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel H300s H300s Firmware and 11 more