CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2024-21982 – CVE-2024-21982 Information Disclosure Vulnerability in ONTAP 9
https://notcve.org/view.php?id=CVE-2024-21982
11 Jan 2024 — ONTAP versions 9.4 and higher are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information to unprivileged attackers when the object-store profiler command is being run by an administrative user. Las versiones de ONTAP 9.4 y superiores son susceptibles a una vulnerabilidad que, cuando se explota con éxito, podría provocar la divulgación de información confidencial a atacantes sin privilegios cuando un usuario administrativo ejecuta el comando del gen... • https://security.netapp.com/advisory/ntap-20240111-0001 •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-27319 – CVE-2023-27319 Information Disclosure Vulnerability in ONTAP Mediator
https://notcve.org/view.php?id=CVE-2023-27319
21 Dec 2023 — ONTAP Mediator versions prior to 1.7 are susceptible to a vulnerability that can allow an unauthenticated attacker to enumerate URLs via REST API. Las versiones de ONTAP Mediator anteriores a la 1.7 son susceptibles a una vulnerabilidad que puede permitir que un atacante no autenticado enumere URLs a través de la API REST. • https://security.netapp.com/advisory/ntap-20231221-0011 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 0CVE-2023-27317 – Information Disclosure Vulnerability in ONTAP 9
https://notcve.org/view.php?id=CVE-2023-27317
15 Dec 2023 — ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a vulnerability which will cause all SAS-attached FIPS 140-2 drives to become unlocked after a system reboot or power cycle or a single SAS-attached FIPS 140-2 drive to become unlocked after reinsertion. This could lead to disclosure of sensitive information to an attacker with physical access to the unlocked drives. ONTAP 9 versiones 9.12.1P8, 9.13.1P4 y 9.13.1P5 son susceptibles a una vulnerabilidad que hará que todas las unidades FIPS 1... • https://security.netapp.com/advisory/NTAP-20231215-0001 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 446EXPL: 1CVE-2023-23583 – Debian Security Advisory 5563-1
https://notcve.org/view.php?id=CVE-2023-23583
14 Nov 2023 — Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege and/or information disclosure and/or denial of service via local access. La secuencia de instrucciones del procesador genera un comportamiento inesperado en Intel(R) Processors que pueden permitir que un usuario autenticado potencialmente habilite la escalada de privilegios y/o la divulgación de información y/o la denegación de servicio a ... • https://github.com/Mav3r1ck0x1/CVE-2023-23583-Reptar- • CWE-276: Incorrect Default Permissions CWE-1281: Sequence of Processor Instructions Leads to Unexpected Behavior •
CVSS: 9.8EPSS: 14%CPEs: 12EXPL: 1CVE-2023-5178 – Kernel: use after free in nvmet_tcp_free_crypto in nvme
https://notcve.org/view.php?id=CVE-2023-5178
01 Nov 2023 — A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation. Se encontró una vulnerabilidad de use-after-free en drivers/nvme/target/tcp.c` en `nvmet_tcp_free_crypto` debido a un error lógico en el subsistema NVMe-oF/TCP en el kernel de Lin... • https://github.com/rockrid3r/CVE-2023-5178 • CWE-416: Use After Free •
CVSS: 10.0EPSS: 94%CPEs: 12EXPL: 30CVE-2023-46604 – Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
https://notcve.org/view.php?id=CVE-2023-46604
27 Oct 2023 — The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this is... • https://packetstorm.news/files/id/175676 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 5%CPEs: 13EXPL: 0CVE-2023-5363 – Incorrect cipher key & IV length processing
https://notcve.org/view.php?id=CVE-2023-5363
24 Oct 2023 — Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes. When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after the key and IV have been establish... • http://www.openwall.com/lists/oss-security/2023/10/24/1 • CWE-325: Missing Cryptographic Step CWE-684: Incorrect Provision of Specified Functionality •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-22115 – mysql: Server: DML unspecified vulnerability (CPU Oct 2023)
https://notcve.org/view.php?id=CVE-2023-22115
17 Oct 2023 — Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). • https://security.netapp.com/advisory/ntap-20231027-0009 •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2023-22114 – mysql: InnoDB unspecified vulnerability (CPU Oct 2023)
https://notcve.org/view.php?id=CVE-2023-22114
17 Oct 2023 — Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). • https://security.netapp.com/advisory/ntap-20231027-0009 •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-22113 – mysql: Server: Security: Encryption unspecified vulnerability (CPU Oct 2023)
https://notcve.org/view.php?id=CVE-2023-22113
17 Oct 2023 — Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). • https://security.netapp.com/advisory/ntap-20231027-0009 •