OA
Product
Oncommand Api Services
19
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 6Medium 3Low 0
Watch
Add Oncommand Api Services to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-10683 | 9.8 | May 1 | dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks Affected: All versions, or not specified |
| CVE-2019-14893 | 9.8 | Mar 2 | A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the… Affected: All versions, or not specified |
| CVE-2020-8840 | 9.8 | Feb 10 | FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter Affected: All versions, or not specified |
| CVE-2019-20330 | 9.8 | Jan 3 | FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking Affected: All versions, or not specified |
| CVE-2019-17267 | 9.8 | Oct 6 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: All versions, or not specified |
| CVE-2019-16943 | 9.8 | Oct 1 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: All versions, or not specified |
| CVE-2019-16942 | 9.8 | Oct 1 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: All versions, or not specified |
| CVE-2019-16335 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: All versions, or not specified |
| CVE-2019-14540 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: All versions, or not specified |
| CVE-2017-5645 | 9.8 | Apr 17 | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary… Affected: All versions, or not specified |
| CVE-2018-14550 | 8.8 | Jul 10 | An issue has been found in third-party PNM decoding associated with libpng 1.6.35 Affected: All versions, or not specified |
| CVE-2021-20190 | 8.1 | Jan 19 | A flaw was found in jackson-databind before 2.9.10.7 Affected: All versions, or not specified |
| CVE-2017-15518 | 7.8 | Feb 23 | All versions of OnCommand API Services prior to 2.1 and NetApp Service Level Manager prior to 1.0RC4 log a privileged database user account password Affected: through 2.0 |
| CVE-2020-25649 | 7.5 | Dec 3 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly Affected: All versions, or not specified |
| CVE-2020-11612 | 7.5 | Apr 7 | The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream Affected: All versions, or not specified |
| CVE-2019-17359 | 7.5 | Oct 8 | The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data Affected: All versions, or not specified |
| CVE-2017-8919 | 6.5 | Jul 25 | NetApp OnCommand API Services before 1.2P3 logs the LDAP BIND password when a user attempts to log in using the REST API, which allows remote authenticated users to obtain… Affected: through 1.2 |
| CVE-2021-21409 | 5.9 | Mar 30 | Possible request smuggling in HTTP/2 due missing validation of content-length Affected: All versions, or not specified |
| CVE-2021-21295 | 5.9 | Mar 9 | Possible request smuggling in HTTP/2 due missing validation Affected: All versions, or not specified |
Showing 19