CVSS: 7.5EPSS: 0%CPEs: 23EXPL: 0CVE-2019-5491
https://notcve.org/view.php?id=CVE-2019-5491
Clustered Data ONTAP versions prior to 9.1P15 and 9.3 prior to 9.3P7 are susceptible to a vulnerability which discloses sensitive information to an unauthenticated user. Clustered Data ONTAP, en sus versiones anteriores a la 9.1P15 y las 9.3 anteriores a la 9.3P7,es susceptible a una vulnerabilidad que divulga información sensible a un usuario no autenticado. • http://www.securityfocus.com/bid/107183 https://security.netapp.com/advisory/ntap-20190227-0001 •
CVSS: 5.9EPSS: 1%CPEs: 180EXPL: 0CVE-2019-1559 – 0-byte record padding oracle
https://notcve.org/view.php?id=CVE-2019-1559
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html http://www.securityfocus.com/bid/107174 https://access. • CWE-203: Observable Discrepancy CWE-325: Missing Cryptographic Step •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-5498
https://notcve.org/view.php?id=CVE-2018-5498
Clustered Data ONTAP versions 9.0 through 9.4 are susceptible to a vulnerability which allows remote authenticated attackers to cause a Denial of Service (DoS) in NFS and SMB environments. Exploitation of this vulnerability will allow a remote authenticated attacker to cause a Denial of Service (DoS) on affected versions of clustered Data ONTAP configured for multiprotocol access. Clustered Data ONTAP, desde la versión 9.0 hasta la 9.4, es susceptible a una vulnerabilidad que permite a los atacantes autenticados de manera remota provocar una vulnerabilidad de denegación de servicio (DoS) en entornos NFS y SMB. La explotación de esta vulnerabilidad permitirá a un atacante remoto autenticado causar una denegación de servicio (DoS) en las versiones afectadas de Clustered Data ONTAP que estén configuradas para el acceso multiprotocolo. • https://security.netapp.com/advisory/ntap-20190115-0001 • CWE-20: Improper Input Validation •
CVSS: 4.4EPSS: 0%CPEs: 18EXPL: 0CVE-2018-5497
https://notcve.org/view.php?id=CVE-2018-5497
Clustered Data ONTAP versions prior to 9.1P16, 9.3P10 and 9.4P5 are susceptible to a vulnerability which discloses sensitive information to an unauthorized user. Clustered Data ONTAP, en sus versiones anteriores a las 9.1P16, 9.3P10 y 9.4P5, es susceptible a una vulnerabilidad que divulga información sensible a un usuario no autenticado. • https://security.netapp.com/advisory/ntap-20190109-0001 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-14583
https://notcve.org/view.php?id=CVE-2017-14583
NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and 9.2P2 are susceptible to a vulnerability which allows an attacker to cause a Denial of Service (DoS) in SMB environments. NetApp Clustered Data ONTAP en versiones 9.x anteriores a 9.1P10 y 9.2P2 son susceptibles a una vulnerabilidad que permite que un atacante provoque una denegación de servicio (DoS) en entornos SMB. • https://security.netapp.com/advisory/ntap-20171215-0001 • CWE-20: Improper Input Validation •