Filtered by vendor Netapp Subscriptions
Filtered by product Hci Compute Node Subscriptions
Total 142 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-5188 7 Canonical, Debian, E2fsprogs Project and 4 more 10 Ubuntu Linux, Debian Linux, E2fsprogs and 7 more 2025-05-30 7.5 High
A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
CVE-2017-5715 8 Arm, Canonical, Debian and 5 more 230 Cortex-a, Ubuntu Linux, Debian Linux and 227 more 2025-05-06 5.6 Medium
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
CVE-2022-35252 6 Apple, Debian, Haxx and 3 more 21 Macos, Debian Linux, Curl and 18 more 2025-05-05 3.7 Low
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.
CVE-2022-32208 7 Apple, Debian, Fedoraproject and 4 more 21 Macos, Debian Linux, Fedora and 18 more 2025-05-05 5.9 Medium
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.
CVE-2022-32206 7 Debian, Fedoraproject, Haxx and 4 more 35 Debian Linux, Fedora, Curl and 32 more 2025-05-05 6.5 Medium
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.
CVE-2022-23308 7 Apple, Debian, Fedoraproject and 4 more 46 Ipados, Iphone Os, Mac Os X and 43 more 2025-05-05 7.5 High
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
CVE-2020-13817 5 Fujitsu, Netapp, Ntp and 2 more 41 M10-1, M10-1 Firmware, M10-4 and 38 more 2025-05-05 7.4 High
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.
CVE-2022-36946 4 Debian, Linux, Netapp and 1 more 10 Debian Linux, Linux Kernel, Active Iq Unified Manager and 7 more 2025-05-05 7.5 High
nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len.
CVE-2021-38160 4 Debian, Linux, Netapp and 1 more 9 Debian Linux, Linux Kernel, Element Software and 6 more 2025-05-05 7.8 High
In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior
CVE-2022-45061 4 Fedoraproject, Netapp, Python and 1 more 13 Fedora, Active Iq Unified Manager, Bootstrap Os and 10 more 2025-05-01 7.5 High
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.
CVE-2022-32207 7 Apple, Debian, Fedoraproject and 4 more 21 Macos, Debian Linux, Fedora and 18 more 2025-04-23 9.8 Critical
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.
CVE-2022-34169 7 Apache, Azul, Debian and 4 more 23 Xalan-java, Zulu, Debian Linux and 20 more 2025-02-13 7.5 High
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
CVE-2022-30594 4 Debian, Linux, Netapp and 1 more 24 Debian Linux, Linux Kernel, 8300 and 21 more 2024-11-21 7.8 High
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.
CVE-2022-30115 3 Haxx, Netapp, Splunk 15 Curl, Clustered Data Ontap, H300s and 12 more 2024-11-21 4.3 Medium
Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.
CVE-2022-2048 5 Debian, Eclipse, Jenkins and 2 more 12 Debian Linux, Jetty, Jenkins and 9 more 2024-11-21 7.5 High
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.
CVE-2022-2047 4 Debian, Eclipse, Netapp and 1 more 9 Debian Linux, Jetty, Element Plug-in For Vcenter Server and 6 more 2024-11-21 2.7 Low
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
CVE-2022-28893 4 Debian, Linux, Netapp and 1 more 25 Debian Linux, Linux Kernel, H300e and 22 more 2024-11-21 7.8 High
The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state.
CVE-2022-28796 4 Fedoraproject, Linux, Netapp and 1 more 24 Fedora, Linux Kernel, Active Iq Unified Manager and 21 more 2024-11-21 7.0 High
jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Linux kernel before 5.17.1 has a use-after-free caused by a transaction_t race condition.
CVE-2022-27781 5 Debian, Haxx, Netapp and 2 more 17 Debian Linux, Curl, Clustered Data Ontap and 14 more 2024-11-21 7.5 High
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
CVE-2022-27780 3 Haxx, Netapp, Splunk 15 Curl, Clustered Data Ontap, H300s and 12 more 2024-11-21 7.5 High
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.