CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-23238
https://notcve.org/view.php?id=CVE-2022-23238
Linux deployments of StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less than 4.7.0 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to view limited metrics information and modify alert email recipients and content. Las implantaciones en Linux de StorageGRID (anteriormente conocido como StorageGRID Webscale) versiones 11.6.0 hasta 11.6.0.2 implantadas con una versión del kernel de Linux inferior a 4.7.0 son susceptibles de una vulnerabilidad que podría permitir a un atacante remoto no autenticado visualizar información de métricas limitada y modificar los destinatarios y el contenido de los correos electrónicos de alerta • https://security.netapp.com/advisory/NTAP-20220808-0001 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23233
https://notcve.org/view.php?id=CVE-2022-23233
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS) of the Local Distribution Router (LDR) service. StorageGRID (anteriormente conocido como StorageGRID Webscale) versiones anteriores a 11.6.0, son susceptibles a una vulnerabilidad que, cuando es explotada con éxito, podría conllevar a una denegación de servicio (DoS) del servicio del router de distribución local (LDR) • https://security.netapp.com/advisory/NTAP-20220303-0010 •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23232
https://notcve.org/view.php?id=CVE-2022-23232
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could allow disabled, expired, or locked external user accounts to access S3 data to which they previously had access. StorageGRID 11.6.0 obtains the user account status from Active Directory or Azure and will block S3 access for disabled user accounts during the subsequent background synchronization. User accounts that are expired or locked for Active Directory or Azure, or user accounts that are disabled, expired, or locked in identity sources other than Active Directory or Azure must be manually removed from group memberships or have their S3 keys manually removed from Tenant Manager in all versions of StorageGRID (formerly StorageGRID Webscale). StorageGRID (anteriormente conocido como StorageGRID Webscale) versiones anteriores a 11.6.0, son susceptibles a una vulnerabilidad que, cuando es explotada con éxito, podría permitir que las cuentas de usuarios externos deshabilitadas, caducadas o bloqueadas accedan a los datos de S3 a los que presentaban acceso anteriormente. StorageGRID versión 11.6.0 obtiene el estado de la cuenta de usuario desde Active Directory o Azure y bloqueará el acceso a S3 de las cuentas de usuario deshabilitadas durante la posterior sincronización en segundo plano. • https://security.netapp.com/advisory/NTAP-20220303-0009 •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27006
https://notcve.org/view.php?id=CVE-2021-27006
StorageGRID (formerly StorageGRID Webscale) versions 11.5 prior to 11.5.0.5 are susceptible to a vulnerability which may allow an administrative user to escalate their privileges and modify settings in SANtricity System Manager. StorageGRID (anteriormente StorageGRID Webscale) versiones 11.5 anteriores a 11.5.0.5, son susceptibles a una vulnerabilidad que puede permitir a un usuario administrativo escalar sus privilegios y modificar la configuración en SANtricity System Manager • https://security.netapp.com/advisory/ntap-20211221-0001 •
CVSS: 4.3EPSS: 0%CPEs: 21EXPL: 0CVE-2020-16166 – kernel: information exposure in drivers/char/random.c and kernel/time/timer.c
https://notcve.org/view.php?id=CVE-2020-16166
The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c. El kernel de Linux versiones hasta 5.7.11, permite a atacantes remotos realizar observaciones que ayudan a obtener información confidencial sobre el estado interno de la red RNG, también se conoce como CID-f227e3ec3b5c. Esto está relacionado con los archivos drivers/char/random.c y kernel/time/timer.c A flaw was found in the Linux kernel. The generation of the device ID from the network RNG internal state is predictable. • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html https://arxiv.org/pdf/2012.07432.pdf https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f227e3ec3b5cad859ad15666874405e8c1bbc1d4 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c51f8f88d705e06bd696d7510aff22b33eb8e638 https://github.com/torvalds/linux/commit/f227e3ec3b5cad859ad15666874405e8c1bbc1d4 https://lists.debian& • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-330: Use of Insufficiently Random Values •