Vulnerabilities (CVE)

Filtered by vendor Netapp Subscribe
Filtered by product Hci Bootstrap Os
Total 22 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2020-8284 9 Apple, Debian, Fedoraproject and 6 more 29 Mac Os X, Macos, Debian Linux and 26 more 2024-03-27 4.3 MEDIUM 3.7 LOW
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
CVE-2020-8285 9 Apple, Debian, Fedoraproject and 6 more 30 Mac Os X, Macos, Debian Linux and 27 more 2024-03-27 5.0 MEDIUM 7.5 HIGH
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
CVE-2020-8286 8 Apple, Debian, Fedoraproject and 5 more 20 Mac Os X, Macos, Debian Linux and 17 more 2024-03-27 5.0 MEDIUM 7.5 HIGH
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
CVE-2022-27774 5 Brocade, Debian, Haxx and 2 more 17 Fabric Operating System, Debian Linux, Curl and 14 more 2024-03-27 3.5 LOW 5.7 MEDIUM
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
CVE-2022-27775 5 Brocade, Debian, Haxx and 2 more 17 Fabric Operating System, Debian Linux, Curl and 14 more 2024-03-27 5.0 MEDIUM 7.5 HIGH
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.
CVE-2022-27776 6 Brocade, Debian, Fedoraproject and 3 more 18 Fabric Operating System, Debian Linux, Fedora and 15 more 2024-03-27 4.3 MEDIUM 6.5 MEDIUM
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
CVE-2022-27779 3 Haxx, Netapp, Splunk 15 Curl, Clustered Data Ontap, H300s and 12 more 2024-03-27 5.0 MEDIUM 5.3 MEDIUM
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
CVE-2022-27780 3 Haxx, Netapp, Splunk 15 Curl, Clustered Data Ontap, H300s and 12 more 2024-03-27 5.0 MEDIUM 7.5 HIGH
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.
CVE-2022-27781 4 Debian, Haxx, Netapp and 1 more 16 Debian Linux, Curl, Clustered Data Ontap and 13 more 2024-03-27 5.0 MEDIUM 7.5 HIGH
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
CVE-2022-30115 3 Haxx, Netapp, Splunk 15 Curl, Clustered Data Ontap, H300s and 12 more 2024-03-27 4.0 MEDIUM 4.3 MEDIUM
Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.
CVE-2021-38160 4 Debian, Linux, Netapp and 1 more 9 Debian Linux, Linux Kernel, Element Software and 6 more 2024-03-21 7.2 HIGH 7.8 HIGH
In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior
CVE-2020-29368 2 Linux, Netapp 9 Linux Kernel, Cloud Backup, Element Software and 6 more 2024-02-15 6.9 MEDIUM 7.0 HIGH
An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check, aka CID-c444eb564fb1.
CVE-2023-28531 2 Netapp, Openbsd 4 Brocade Fabric Operating System, Hci Bootstrap Os, Solidfire Element Os and 1 more 2024-02-12 N/A 9.8 CRITICAL
ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.
CVE-2021-4209 3 Gnu, Netapp, Redhat 6 Gnutls, Active Iq Unified Manager, Hci Bootstrap Os and 3 more 2023-12-10 N/A 6.5 MEDIUM
A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.
CVE-2022-36879 3 Debian, Linux, Netapp 43 Debian Linux, Linux Kernel, A700s and 40 more 2023-12-10 N/A 5.5 MEDIUM
An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.
CVE-2021-38202 2 Linux, Netapp 7 Linux Kernel, Element Software, Hci Bootstrap Os and 4 more 2023-12-10 5.0 MEDIUM 7.5 HIGH
fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd.
CVE-2021-38203 2 Linux, Netapp 7 Linux Kernel, Element Software, Hci Bootstrap Os and 4 more 2023-12-10 2.1 LOW 5.5 MEDIUM
btrfs in the Linux kernel before 5.13.4 allows attackers to cause a denial of service (deadlock) via processes that trigger allocation of new system chunks during times when there is a shortage of free space in the system space_info.
CVE-2021-38201 2 Linux, Netapp 7 Linux Kernel, Element Software, Hci Bootstrap Os and 4 more 2023-12-10 5.0 MEDIUM 7.5 HIGH
net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.
CVE-2021-38199 3 Debian, Linux, Netapp 8 Debian Linux, Linux Kernel, Element Software and 5 more 2023-12-10 3.3 LOW 6.5 MEDIUM
fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for those servers to be unreachable during trunking detection.
CVE-2020-12771 6 Canonical, Debian, Linux and 3 more 37 Ubuntu Linux, Debian Linux, Linux Kernel and 34 more 2023-12-10 4.9 MEDIUM 5.5 MEDIUM
An issue was discovered in the Linux kernel through 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c has a deadlock if a coalescing operation fails.