Vulnerabilidades en NetApp

69 resultados
Análisis Vexday

Com 61 CVEs catalogadas e nenhuma em exploração ativa confirmada pelo CISA KEV, o perfil de risco imediato dos produtos NetApp situa-se abaixo da média geral do catálogo, o que sugere menor pressão operacional para resposta emergencial. O único CVE de severidade crítica com maior pontuação EPSS observada é o CVE-2018-5488, que apesar de datar de alguns anos ainda registra EPSS de 0,0397 — valor modesto, mas suficiente para justificar verificação de exposição em ambientes que ainda executem versões afetadas. A ausência de PoCs públicas conhecidas e de novas CVEs nos últimos 90 dias reduz a superfície de ataque imediata, embora não elimine a necessidade de monitoramento contínuo. O tipo de falha mais recorrente, CWE-269 (gerenciamento impróprio de privilégios), merece atenção em revisões de controle de acesso e hardening de configuração.

CVE-2018-5488—NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 1EPSS 4.0%CVE-2018-5492—NetApp E-Series SANtricity OS Controller Software 11.30 and later version 11.30.5 is susceptible to unauthenticated remote code execution.EPSS 2.9%CVE-2018-5487—NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RMEPSS 2.9%CVE-2019-5497—NetApp AFF A700s Baseboard Management Controller (BMC) firmware versions 1.22 and higher were shipped with a default account enabled that coEPSS 2.9%CVE-2019-17275—OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers.EPSS 2.8%CVE-2019-5509—ONTAP Select Deploy administration utility versions 2.11.2 through 2.12.2 are susceptible to a code injection vulnerability which when succeEPSS 2.3%CVE-2019-5501—Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 may disclose sensitive LDAP account information to unauthenticated remote attackersEPSS 2.0%CVE-2019-5491—Clustered Data ONTAP versions prior to 9.1P15 and 9.3 prior to 9.3P7 are susceptible to a vulnerability which discloses sensitive informatioEPSS 1.9%CVE-2020-8571—StorageGRID (formerly StorageGRID Webscale) versions 10.0.0 through 11.3 prior to 11.2.0.8 and 11.3.0.4 are susceptible to a vulnerability wEPSS 1.8%CVE-2018-5495—All StorageGRID Webscale versions are susceptible to a vulnerability which could permit an unauthenticated attacker to communicate with systEPSS 1.6%CVE-2019-5495—OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which EPSS 1.4%CVE-2019-5493—Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 are susceptible to a vulnerability which discloses information to an unauthenticateEPSS 1.4%CVE-2017-7568—NetApp OnCommand Unified Manager for 7-Mode (core package) versions prior to 5.2.3 may disclose sensitive LDAP account information to authenEPSS 1.4%CVE-2018-5499—ATTO FibreBridge 7500N firmware version 2.95 is susceptible to a vulnerability which allows attackers to cause a Denial of Service (DoS).EPSS 1.3%CVE-2020-8573—The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers (BMC) are shipped with a documented default account and password thatEPSS 1.3%CVE-2019-17272—All versions of ONTAP Select Deploy administration utility are susceptible to a vulnerability which when successfully exploited could allow EPSS 1.3%CVE-2018-5498—Clustered Data ONTAP versions 9.0 through 9.4 are susceptible to a vulnerability which allows remote authenticated attackers to cause a DeniEPSS 1.2%CVE-2017-15519—Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for NEPSS 1.2%CVE-2016-6904—Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. This could alEPSS 1.2%CVE-2017-11461—NetApp OnCommand Unified Manager for 7-mode (core package) versions prior to 5.2.1 are susceptible to a clickjacking or "UI redress attack" EPSS 1.0%