Product:

Active_iq_unified_manager

(Netapp)
Repositories • https://github.com/madler/zlib
• https://github.com/lodash/lodash
• https://github.com/mm2/Little-CMS
• https://github.com/openbsd/src
#Vulnerabilities 819
Date Id Summary Products Score Patch Annotated
2023-02-17 CVE-2023-24329 An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. Fedora, Active_iq_unified_manager, Management_services_for_element_software, Management_services_for_netapp_hci, Ontap_select_deploy_administration_utility, Python 7.5
2023-02-17 CVE-2023-0482 In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user. Active_iq_unified_manager, Oncommand_workflow_automation, Resteasy 5.5
2023-02-28 CVE-2022-23240 Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability which allows unauthorized users to update EMS Subscriptions via unspecified vectors. Active_iq_unified_manager 6.5
2024-04-16 CVE-2024-21055 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS... Active_iq_unified_manager, Bluexp, Oncommand_insight, Oncommand_workflow_automation, Snapcenter, Mysql N/A
2018-08-22 CVE-2018-11776 Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace. Struts, Active_iq_unified_manager, Oncommand_insight, Oncommand_workflow_automation, Snapcenter, Communications_policy_management, Enterprise_manager_base_platform, Mysql_enterprise_monitor 8.1
2023-09-12 CVE-2023-4863 Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) Honeyview, Seequent_leapfrog, Debian_linux, Fedora, Chrome, Edge_chromium, Teams, Webp_image_extension, Firefox, Thunderbird, Active_iq_unified_manager, Libwebp 8.8
2024-03-18 CVE-2024-26641 In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() syzbot found __ip6_tnl_rcv() could access unitiliazed data [1]. Call pskb_inet_may_pull() to fix this, and initialize ipv6h variable after this call as it can change skb->head. [1] BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG:... Debian_linux, Linux_kernel, A150_firmware, A220_firmware, A800_firmware, A900_firmware, A9500_firmware, Active_iq_unified_manager, C190_firmware, C800_firmware, Fas2720_firmware, Fas2750_firmware, Fas2820_firmware, Ontap_select_deploy_administration_utility 5.5
2023-02-23 CVE-2023-23914 A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on. Curl, Active_iq_unified_manager, Clustered_data_ontap, H300s_firmware, H410s_firmware, H500s_firmware, H700s_firmware, Universal_forwarder 9.1
2022-05-16 CVE-2022-1586 An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT. Debian_linux, Fedora, Active_iq_unified_manager, H300s_firmware, H410c_firmware, H410s_firmware, H500s_firmware, H700s_firmware, Hci_management_node, Ontap_select_deploy_administration_utility, Solidfire, Pcre2, Enterprise_linux 9.1
2024-03-10 CVE-2024-28757 libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate). Fedora, Libexpat, Active_iq_unified_manager, H300s_firmware, H410c_firmware, H410s_firmware, H500s_firmware, H610c_firmware, H610s_firmware, H700s_firmware, Oncommand_workflow_automation, Ontap, Ontap_tools, Windows_host_utilities 7.5