* * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2021-45105	20	DoS	2021-12-18	2022-10-06	4.3	None	Remote	Medium	Not required	None	None	Partial
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
2	CVE-2021-44228	20	Exec Code	2021-12-10	2023-04-03	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
3	CVE-2021-42550	502	Exec Code	2021-12-16	2022-12-12	8.5	None	Remote	Medium	???	Complete	Complete	Complete
In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
4	CVE-2021-31808	190	DoS	2021-05-27	2022-07-12	4.0	None	Remote	Low	???	None	None	Partial
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP Range request to trigger this.
5	CVE-2021-31807	190	DoS Overflow	2021-06-08	2021-09-14	4.0	None	Remote	Low	???	None	None	Partial
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server to achieve Denial of Service when delivering responses to HTTP Range requests. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent.
6	CVE-2021-31806	116	DoS	2021-05-27	2021-09-14	4.0	None	Remote	Low	???	None	None	Partial
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request processing.
7	CVE-2021-28651	401	DoS	2021-05-27	2021-09-14	5.0	None	Remote	Low	Not required	None	None	Partial
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of memory consumption.
8	CVE-2021-28164			2021-04-01	2022-07-14	5.0	None	Remote	Low	Not required	Partial	None	None
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
9	CVE-2021-28163	59		2021-04-01	2022-05-12	4.0	None	Remote	Low	???	Partial	None	None
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
10	CVE-2021-23337	94		2021-02-15	2022-09-13	6.5	None	Remote	Low	???	Partial	Partial	Partial
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
11	CVE-2020-25097	20		2021-03-19	2022-04-05	5.0	None	Remote	Low	Not required	Partial	None	None
An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.
12	CVE-2020-14058		DoS	2020-06-30	2022-04-28	5.0	None	Remote	Low	Not required	None	None	Partial
An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.

Total number of vulnerabilities : 12 Page : 1 (This Page)