Filtered by vendor Netapp Subscriptions
Filtered by product Hci Bootstrap Os Subscriptions
Total 22 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-28531 2 Netapp, Openbsd 4 Brocade Fabric Operating System, Hci Bootstrap Os, Solidfire Element Os and 1 more 2024-11-21 9.8 Critical
ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.
CVE-2022-36879 4 Debian, Linux, Netapp and 1 more 46 Debian Linux, Linux Kernel, A700s and 43 more 2024-11-21 5.5 Medium
An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.
CVE-2022-30115 3 Haxx, Netapp, Splunk 15 Curl, Clustered Data Ontap, H300s and 12 more 2024-11-21 4.3 Medium
Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.
CVE-2022-27781 5 Debian, Haxx, Netapp and 2 more 17 Debian Linux, Curl, Clustered Data Ontap and 14 more 2024-11-21 7.5 High
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
CVE-2022-27780 3 Haxx, Netapp, Splunk 15 Curl, Clustered Data Ontap, H300s and 12 more 2024-11-21 7.5 High
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.
CVE-2022-27779 3 Haxx, Netapp, Splunk 15 Curl, Clustered Data Ontap, H300s and 12 more 2024-11-21 5.3 Medium
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
CVE-2022-27776 7 Brocade, Debian, Fedoraproject and 4 more 19 Fabric Operating System, Debian Linux, Fedora and 16 more 2024-11-21 6.5 Medium
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
CVE-2022-27775 6 Brocade, Debian, Haxx and 3 more 18 Fabric Operating System, Debian Linux, Curl and 15 more 2024-11-21 7.5 High
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.
CVE-2022-27774 6 Brocade, Debian, Haxx and 3 more 18 Fabric Operating System, Debian Linux, Curl and 15 more 2024-11-21 5.7 Medium
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
CVE-2021-4209 3 Gnu, Netapp, Redhat 6 Gnutls, Active Iq Unified Manager, Hci Bootstrap Os and 3 more 2024-11-21 6.5 Medium
A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.
CVE-2021-38203 2 Linux, Netapp 7 Linux Kernel, Element Software, Hci Bootstrap Os and 4 more 2024-11-21 5.5 Medium
btrfs in the Linux kernel before 5.13.4 allows attackers to cause a denial of service (deadlock) via processes that trigger allocation of new system chunks during times when there is a shortage of free space in the system space_info.
CVE-2021-38202 2 Linux, Netapp 7 Linux Kernel, Element Software, Hci Bootstrap Os and 4 more 2024-11-21 7.5 High
fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd.
CVE-2021-38201 3 Linux, Netapp, Redhat 8 Linux Kernel, Element Software, Hci Bootstrap Os and 5 more 2024-11-21 7.5 High
net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.
CVE-2021-38199 3 Debian, Linux, Netapp 8 Debian Linux, Linux Kernel, Element Software and 5 more 2024-11-21 6.5 Medium
fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for those servers to be unreachable during trunking detection.
CVE-2021-38160 4 Debian, Linux, Netapp and 1 more 9 Debian Linux, Linux Kernel, Element Software and 6 more 2024-11-21 7.8 High
In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior
CVE-2020-8286 9 Apple, Debian, Fedoraproject and 6 more 22 Mac Os X, Macos, Debian Linux and 19 more 2024-11-21 7.5 High
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
CVE-2020-8285 10 Apple, Debian, Fedoraproject and 7 more 32 Mac Os X, Macos, Debian Linux and 29 more 2024-11-21 7.5 High
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
CVE-2020-8284 10 Apple, Debian, Fedoraproject and 7 more 31 Mac Os X, Macos, Debian Linux and 28 more 2024-11-21 3.7 Low
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
CVE-2020-29368 3 Linux, Netapp, Redhat 11 Linux Kernel, Cloud Backup, Element Software and 8 more 2024-11-21 7.0 High
An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check, aka CID-c444eb564fb1.
CVE-2020-16166 8 Canonical, Debian, Fedoraproject and 5 more 18 Ubuntu Linux, Debian Linux, Fedora and 15 more 2024-11-21 3.7 Low
The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c.