Oncommand Shift vulnerabilities | LiveThreat CVE Feed

Product

Oncommand Shift

by Netapp · last CVE Feb 6, 2018

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities64 In the news0 Timeline

Severity mix

Critical 19High 21Medium 22Low 2

Severity

All severities64 Critical19 High21 Medium22 Low2

Exploitation

On CISA KEV4 Exploited in the wild4

Watch

Add Oncommand Shift to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2016-8735 In wildKEV	9.8	90%	Apr 6	Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if… Affected: All versions, or not specified
CVE-2016-3427 In wildKEV	9.8	92%	Apr 21	Oracle Java SE and JRockit Unspecified Vulnerability Affected: All versions, or not specified
CVE-2017-12617 In wildKEV	8.1	100%	Oct 3	When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g Affected: All versions, or not specified
CVE-2017-12615 RansomwareIn wildKEV	8.1	100%	Sep 19	When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g Affected: All versions, or not specified
CVE-2017-15095	9.8	8%	Feb 6	A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending… Affected: All versions, or not specified
CVE-2017-7525	9.8	38%	Feb 6	A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by… Affected: All versions, or not specified
CVE-2017-17485	9.8	50%	Jan 10	FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization… Affected: All versions, or not specified
CVE-2016-9841	9.8	8%	May 23	inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic Affected: All versions, or not specified
CVE-2017-10346	9.6	3%	Oct 19	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: All versions, or not specified
CVE-2017-10285	9.6	3%	Oct 19	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: All versions, or not specified
CVE-2017-10111	9.6	2%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: All versions, or not specified
CVE-2017-10110	9.6	2%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT) Affected: All versions, or not specified
CVE-2017-10107	9.6	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: All versions, or not specified
CVE-2017-10101	9.6	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) Affected: All versions, or not specified
CVE-2017-10096	9.6	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) Affected: All versions, or not specified
CVE-2017-10090	9.6	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: All versions, or not specified
CVE-2017-10089	9.6	2%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: ImageIO) Affected: All versions, or not specified
CVE-2017-10087	9.6	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: All versions, or not specified
CVE-2017-10086	9.6	2%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX) Affected: All versions, or not specified
CVE-2016-5018	9.1	10%	Aug 10	In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured… Affected: All versions, or not specified
CVE-2017-10102	9.0	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: All versions, or not specified
CVE-2018-2638	8.3	3%	Jan 18	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment) Affected: All versions, or not specified
CVE-2017-10116	8.3	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security) Affected: All versions, or not specified
CVE-2017-10114	8.3	2%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX) Affected: All versions, or not specified
CVE-2017-10074	8.3	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: All versions, or not specified
CVE-2018-5968	8.1	7%	Jan 22	FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and… Affected: All versions, or not specified
CVE-2017-10078	8.1	2%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting) Affected: All versions, or not specified
CVE-2015-8960	8.1	2%	Sep 21	The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the… Affected: All versions, or not specified
CVE-2018-2627	7.5	0%	Jan 18	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Installer) Affected: All versions, or not specified
CVE-2017-10388	7.5	3%	Oct 19	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: All versions, or not specified
CVE-2016-6796	7.5	8%	Aug 11	A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured… Affected: All versions, or not specified
CVE-2016-6797	7.5	8%	Aug 10	The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web… Affected: All versions, or not specified
CVE-2017-10176	7.5	5%	Aug 8	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security) Affected: All versions, or not specified
CVE-2017-10118	7.5	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE) Affected: All versions, or not specified
CVE-2017-10115	7.5	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE) Affected: All versions, or not specified
CVE-2017-10067	7.5	3%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security) Affected: All versions, or not specified
CVE-2016-8747	7.5	7%	Mar 14	An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations Affected: All versions, or not specified
CVE-2017-10309	7.1	9%	Oct 19	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment) Affected: All versions, or not specified
CVE-2017-10125	7.1	1%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment) Affected: All versions, or not specified
CVE-2016-10165	7.1	3%	Feb 3	The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted… Affected: All versions, or not specified
CVE-2017-10274	6.8	3%	Oct 19	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Smart Card IO) Affected: All versions, or not specified
CVE-2017-10198	6.8	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security) Affected: All versions, or not specified
CVE-2017-10243	6.5	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAX-WS) Affected: All versions, or not specified
CVE-2017-10356	6.2	1%	Oct 19	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security) Affected: All versions, or not specified
CVE-2017-10293	6.1	1%	Oct 19	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Javadoc) Affected: All versions, or not specified
CVE-2016-0762	5.9	8%	Aug 10	The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied… Affected: All versions, or not specified
CVE-2017-10135	5.9	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE) Affected: All versions, or not specified
CVE-2017-10357	5.3	3%	Oct 19	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Serialization) Affected: All versions, or not specified
CVE-2017-10355	5.3	16%	Oct 19	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking) Affected: All versions, or not specified
CVE-2017-10350	5.3	3%	Oct 19	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAX-WS) Affected: All versions, or not specified