Filtered by vendor Netapp Subscriptions
Filtered by product Hci Storage Node Subscriptions
Total 39 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-22876 9 Broadcom, Debian, Fedoraproject and 6 more 15 Fabric Operating System, Debian Linux, Fedora and 12 more 2024-11-21 5.3 Medium
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.
CVE-2020-8698 6 Debian, Fedoraproject, Intel and 3 more 54 Debian Linux, Fedora, Core I3-1000g1 and 51 more 2024-11-21 5.5 Medium
Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2020-8696 5 Debian, Fedoraproject, Intel and 2 more 507 Debian Linux, Fedora, Celeron 3855u and 504 more 2024-11-21 5.5 Medium
Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2020-8584 1 Netapp 4 Element Os, Hci Management Node, Hci Storage Node and 1 more 2024-11-21 9.8 Critical
Element OS versions prior to 1.8P1 and 12.2 are susceptible to a vulnerability that could allow an unauthenticated remote attacker to perform arbitrary code execution.
CVE-2020-8286 9 Apple, Debian, Fedoraproject and 6 more 22 Mac Os X, Macos, Debian Linux and 19 more 2024-11-21 7.5 High
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
CVE-2020-8285 10 Apple, Debian, Fedoraproject and 7 more 32 Mac Os X, Macos, Debian Linux and 29 more 2024-11-21 7.5 High
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
CVE-2020-8284 10 Apple, Debian, Fedoraproject and 7 more 31 Mac Os X, Macos, Debian Linux and 28 more 2024-11-21 3.7 Low
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
CVE-2020-29369 2 Linux, Netapp 5 Linux Kernel, Hci Compute Node, Hci Management Node and 2 more 2024-11-21 7.0 High
An issue was discovered in mm/mmap.c in the Linux kernel before 5.7.11. There is a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe.
CVE-2020-26116 8 Canonical, Debian, Fedoraproject and 5 more 12 Ubuntu Linux, Debian Linux, Fedora and 9 more 2024-11-21 7.2 High
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.
CVE-2020-1971 9 Debian, Fedoraproject, Netapp and 6 more 55 Debian Linux, Fedora, Active Iq Unified Manager and 52 more 2024-11-21 5.9 Medium
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).
CVE-2020-15778 4 Broadcom, Netapp, Openbsd and 1 more 11 Fabric Operating System, A700s, A700s Firmware and 8 more 2024-11-21 7.8 High
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
CVE-2020-14145 3 Netapp, Openbsd, Redhat 11 Active Iq Unified Manager, Aff A700s, Aff A700s Firmware and 8 more 2024-11-21 5.9 Medium
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.
CVE-2019-19462 5 Canonical, Debian, Linux and 2 more 9 Ubuntu Linux, Debian Linux, Linux Kernel and 6 more 2024-11-21 5.5 Medium
relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result.
CVE-2019-19069 4 Broadcom, Canonical, Linux and 1 more 21 Fabric Operating System, Ubuntu Linux, Linux Kernel and 18 more 2024-11-21 7.5 High
A memory leak in the fastrpc_dma_buf_attach() function in drivers/misc/fastrpc.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering dma_get_sgtable() failures, aka CID-fc739a058d99.
CVE-2019-19050 5 Broadcom, Canonical, Fedoraproject and 2 more 22 Fabric Operating System, Ubuntu Linux, Fedora and 19 more 2024-11-21 7.5 High
A memory leak in the crypto_reportstat() function in crypto/crypto_user_stat.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_reportstat_alg() failures, aka CID-c03b04dcdba1.
CVE-2019-18805 5 Broadcom, Linux, Netapp and 2 more 22 Fabric Operating System, Linux Kernel, Active Iq Unified Manager and 19 more 2024-11-21 9.8 Critical
An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6.
CVE-2019-17006 4 Mozilla, Netapp, Redhat and 1 more 27 Network Security Services, Hci Compute Node, Hci Management Node and 24 more 2024-11-21 9.8 Critical
In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.
CVE-2019-11815 5 Canonical, Debian, Linux and 2 more 15 Ubuntu Linux, Debian Linux, Linux Kernel and 12 more 2024-11-21 8.1 High
An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cleanup.
CVE-2017-7658 6 Debian, Eclipse, Hp and 3 more 21 Debian Linux, Jetty, Xp P9000 and 18 more 2024-11-21 9.8 Critical
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.