CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-21990 – Default Privileged Account Credentials Vulnerability in ONTAP Select Deploy administration utility
https://notcve.org/view.php?id=CVE-2024-21990
17 Apr 2024 — ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deploy configuration information and modify the account credentials. Las versiones 9.12.1.x, 9.13.1.x y 9.14.1.x de la utilidad de administración ONTAP Select Deploy contienen credenciales codificadas que podrían permitir a un atacante ver la información de configuración de Deploy y modificar las credenciales de la cuenta. • https://security.netapp.com/advisory/ntap-20240411-0002 • CWE-259: Use of Hard-coded Password •
CVSS: 8.0EPSS: 0%CPEs: 10EXPL: 0CVE-2024-21985 – Privilege Escalation Vulnerability in ONTAP 9
https://notcve.org/view.php?id=CVE-2024-21985
26 Jan 2024 — ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 and 9.13.1P4 are susceptible to a vulnerability which could allow an authenticated user with multiple remote accounts with differing roles to perform actions via REST API beyond their intended privilege. Possible actions include viewing limited configuration details and metrics or modifying limited settings, some of which could result in a Denial of Service (DoS). Las versiones de ONTAP 9 anteriores a 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P... • https://security.netapp.com/advisory/ntap-20240126-0001 • CWE-269: Improper Privilege Management •
CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2024-21982 – CVE-2024-21982 Information Disclosure Vulnerability in ONTAP 9
https://notcve.org/view.php?id=CVE-2024-21982
11 Jan 2024 — ONTAP versions 9.4 and higher are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information to unprivileged attackers when the object-store profiler command is being run by an administrative user. Las versiones de ONTAP 9.4 y superiores son susceptibles a una vulnerabilidad que, cuando se explota con éxito, podría provocar la divulgación de información confidencial a atacantes sin privilegios cuando un usuario administrativo ejecuta el comando del gen... • https://security.netapp.com/advisory/ntap-20240111-0001 •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2023-27314 – Denial of Service Vulnerability in ONTAP 9
https://notcve.org/view.php?id=CVE-2023-27314
12 Oct 2023 — ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to cause a crash of the HTTP service. Las versiones de ONTAP 9 anteriores a 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 y 9.13.1 son susceptibles a una vulnerabilidad que podría permitir que un atacante remoto no autenticado provoque una falla del servicio HTTP. • https://security.netapp.com/advisory/ntap-20231009-0001 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.8EPSS: 2%CPEs: 9EXPL: 0CVE-2023-36054 – krb5: Denial of service through freeing uninitialized pointer
https://notcve.org/view.php?id=CVE-2023-36054
07 Aug 2023 — lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count. A vulnerability was found in the _xdr_kadm5_principal_ent_rec() function in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (krb5). This issue occurs due to lack of validation in the relationship betwee... • https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd • CWE-824: Access of Uninitialized Pointer •
CVSS: 7.8EPSS: 0%CPEs: 21EXPL: 0CVE-2023-3107 – Remote denial of service in IPv6 fragment reassembly
https://notcve.org/view.php?id=CVE-2023-3107
01 Aug 2023 — A set of carefully crafted ipv6 packets can trigger an integer overflow in the calculation of a fragment reassembled packet's payload length field. This allows an attacker to trigger a kernel panic, resulting in a denial of service. Un conjunto de paquetes ipv6 cuidadosamente diseñados puede desencadenar un desbordamiento de enteros en el cálculo del campo de longitud de la carga útil de un paquete reensamblado por fragmentos. Esto permite a un atacante desencadenar un kernel panic, resultando en una denega... • https://security.FreeBSD.org/advisories/FreeBSD-SA-23:06.ipv6.asc • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.8EPSS: 9%CPEs: 9EXPL: 0CVE-2023-38403 – iperf3: memory allocation hazard and crash
https://notcve.org/view.php?id=CVE-2023-38403
17 Jul 2023 — iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. An integer overflow flaw was found in the way iperf3 dynamically allocates memory buffers for JSON-formatted messages. A remote attacker could send a specially crafted sequence of bytes on the iperf3 control channel with a specified JSON message length of 0xffffffff to trigger an integer overflow leading the receiving process to abort due to heap corruption. This flaw allows an attacker to use a mali... • http://seclists.org/fulldisclosure/2023/Oct/24 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.8EPSS: 3%CPEs: 19EXPL: 0CVE-2023-2953 – openldap: null pointer dereference in ber_memalloc_x function
https://notcve.org/view.php?id=CVE-2023-2953
30 May 2023 — A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function. A vulnerability was found in OpenLDAP, in ber_memalloc_x() function, leading to a null pointer dereference. This flaw can result in reduced system memory and cause LDAP authentication failures. The impact is primarily a disruption in authentication processes, which may hinder user access or service operations relying on LDAP for authentication. • http://seclists.org/fulldisclosure/2023/Jul/47 • CWE-476: NULL Pointer Dereference •
CVSS: 9.1EPSS: 1%CPEs: 14EXPL: 1CVE-2023-28319 – curl: use after free in SSH sha256 fingerprint check
https://notcve.org/view.php?id=CVE-2023-28319
26 May 2023 — A use after free vulnerability exists in curl
CVSS: 9.1EPSS: 8%CPEs: 14EXPL: 1CVE-2023-28320 – Apple Security Advisory 2023-07-24-6
https://notcve.org/view.php?id=CVE-2023-28320
26 May 2023 — A denial of service vulnerability exists in curl