CM
Product
Cloud Manager
On CISA KEVExploited in the wildRansomware-linked
19
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 2High 8Medium 8Low 1
Watch
Add Cloud Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-44228 RansomwareIn wildKEV | 10.0 | Dec 10 | Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints Affected: All versions, or not specified |
| CVE-2021-26990 | 9.1 | Mar 19 | Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability that could allow a remote attacker to overwrite arbitrary system files Affected: before 3.9.4 |
| CVE-2020-25097 | 8.6 | Mar 19 | An issue was discovered in Squid through 4.13 and 5.x through 5.0.4 Affected: All versions, or not specified |
| CVE-2021-27002 | 7.5 | Oct 11 | NetApp Cloud Manager versions prior to 3.9.10 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to retrieve sensitive data via the web proxy Affected: before 3.9.10 |
| CVE-2021-28651 | 7.5 | May 27 | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6 Affected: All versions, or not specified |
| CVE-2021-28165 | 7.5 | Apr 1 | In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame Affected: before 3.9.8 |
| CVE-2021-26992 | 7.5 | Mar 19 | Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability which could allow a remote attacker to cause a Denial of Service (DoS) Affected: before 3.9.4 |
| CVE-2021-26991 | 7.5 | Mar 19 | Cloud Manager versions prior to 3.9.4 contain an insecure Cross-Origin Resource Sharing (CORS) policy which could allow a remote attacker to interact with Cloud Manager Affected: before 3.9.4 |
| CVE-2020-14058 | 7.5 | Jun 30 | An issue was discovered in Squid before 4.12 and 5.x before 5.0.3 Affected: All versions, or not specified |
| CVE-2021-23337 | 7.2 | Feb 15 | Command Injection Affected: All versions, or not specified |
| CVE-2021-42550 | 6.6 | Dec 16 | In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute… Affected: All versions, or not specified |
| CVE-2021-31807 | 6.5 | Jun 8 | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6 Affected: All versions, or not specified |
| CVE-2021-31808 | 6.5 | May 27 | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6 Affected: All versions, or not specified |
| CVE-2021-31806 | 6.5 | May 27 | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6 Affected: All versions, or not specified |
| CVE-2021-45105 | 5.9 | Dec 18 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups Affected: All versions, or not specified |
| CVE-2021-28164 | 5.3 | Apr 1 | In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources… Affected: All versions, or not specified |
| CVE-2021-26999 | 4.3 | Aug 6 | NetApp Cloud Manager versions prior to 3.9.9 log sensitive information when an Active Directory connection fails Affected: before 3.9.9 |
| CVE-2021-26998 | 4.3 | Aug 6 | NetApp Cloud Manager versions prior to 3.9.9 log sensitive information that is available only to authenticated users Affected: before 3.9.9 |
| CVE-2021-28163 | 2.7 | Apr 1 | In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory… Affected: All versions, or not specified |
Showing 19