CVSS: 9.8EPSS: 1%CPEs: 35EXPL: 0CVE-2017-3167 – httpd: ap_get_basic_auth_pw() authentication bypass
https://notcve.org/view.php?id=CVE-2017-3167
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. En Apache httpd, en versiones 2.2.x anteriores a la 2.2.33 y versiones 2.4.x anteriores a la 2.4.26, el uso de ap_get_basic_auth_pw() por parte de módulos de terceros fuera de la fase de autenticación puede dar lugar a que se omitan requisitos de autenticación.. It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw to bypass required authentication if the API was used incorrectly by one of the modules used by httpd. • http://www.debian.org/security/2017/dsa-3896 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.securityfocus.com/bid/99135 http://www.securitytracker.com/id/1038711 https://access.redhat.com/errata/RHSA-2017:2478 https://access.redhat.com/errata/RHSA-2017:2479 https://access.redhat.com/errata/RHSA-2017:2483 https://access.redhat.com/errata/RHSA-2017:3193 https://access.redhat.com/errata/RHSA-2017:3194 https://access.redhat.com/errata/RHS • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 1CVE-2017-9119
https://notcve.org/view.php?id=CVE-2017-9119
The i_zval_ptr_dtor function in Zend/zend_variables.h in PHP 7.1.5 allows attackers to cause a denial of service (memory consumption and application crash) or possibly have unspecified other impact by triggering crafted operations on array data structures. La función i_zval_ptr_dtor en el archivo Zend/zend_variables.h en PHP versión 7.1.5 permite a los atacantes causar una denegación de servicio (consumo de memoria y bloqueo de aplicación) o posiblemente tener otro impacto sin especificar al desencadenar operaciones creadas en la estructuras de datos de matriz. • http://www.securityfocus.com/bid/98596 https://bugs.php.net/bug.php?id=74593 https://security.netapp.com/advisory/ntap-20180112-0001 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 0CVE-2017-5988
https://notcve.org/view.php?id=CVE-2017-5988
NetApp Clustered Data ONTAP 8.1 through 9.1P1, when NFS or SMB is enabled, allows remote attackers to cause a denial of service via unspecified vectors. NetApp Clustered Data ONTAP 8.1 hasta la versión 9.1P1, cuando NFS o SMB está habilitado, permite a los atacantes remotos causar una denegación de servicio a través de vectores no especificados. • https://kb.netapp.com/support/s/article/NTAP-20170331-0001 •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7345
https://notcve.org/view.php?id=CVE-2017-7345
NetApp OnCommand Performance Manager and OnCommand Unified Manager for Clustered Data ONTAP before 7.1P1 improperly bind the Java Management Extension Remote Method Invocation (aka JMX RMI) service to the network, which allows remote attackers to obtain sensitive information via unspecified vectors. NetApp OnCommand Performance Manager y OnCommand Unified Manager para datos en clúster ONTAP en versiones anteriores a 7.1P1 vincula incorrectamente el servicio de Java Management Extension Remote Method Invocation (también conocido como JMX RMI) a la red, lo que permite a atacantes remotos obtener información confidencial a través de vectores no especificados. • http://www.securityfocus.com/bid/97537 https://kb.netapp.com/support/s/article/NTAP-20170331-0002 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-4341
https://notcve.org/view.php?id=CVE-2016-4341
NetApp Clustered Data ONTAP before 8.3.2P7 allows remote attackers to obtain SMB share information via unspecified vectors. NetApp Clustered Data ONTAP en versiones anteriores a 8.3.2P7 permite a atacantes remotos obtener información compartida SMB a través de vectores no especificados. • https://kb.netapp.com/support/s/article/NTAP-20161028-0001 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •