OS
Product
Oncommand System Manager
On CISA KEVExploited in the wild
27
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 10Medium 13Low 0
Watch
Add Oncommand System Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-1938 In wildKEV | 9.8 | Feb 24 | Apache Tomcat Improper Privilege Management Vulnerability Affected: 3.0.0 through 3.1.3 |
| CVE-2020-11023 In wildKEV | 6.1 | Apr 29 | Potential XSS vulnerability in jQuery Affected: 3.0 through 3.1.3 |
| CVE-2019-17571 | 9.8 | Dec 20 | Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with… Affected: 3.0 through 3.1.3 |
| CVE-2017-7658 | 9.8 | Jun 26 | In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths… Affected: 3.0 through 3.1.3 |
| CVE-2017-7657 | 9.8 | Jun 26 | In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled… Affected: 3.x |
| CVE-2018-12538 | 8.8 | Jun 22 | In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a… Affected: 3.0.0 through 3.1.3 |
| CVE-2016-5045 | 8.1 | Jul 3 | NetApp OnCommand System Manager before 9.0 allows remote attackers to obtain sensitive credentials via vectors related to cluster peering setup Affected: 8.3; 8.3.1; 8.3.2 |
| CVE-2020-17527 | 7.5 | Dec 3 | Apache Tomcat: Request header mix-up between HTTP/2 streams Affected: 3.0.0 through 3.1.3 |
| CVE-2020-13935 | 7.5 | Jul 14 | The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104 Affected: 3.0.0 through 3.1.3 |
| CVE-2020-13934 | 7.5 | Jul 14 | An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2 Affected: 3.0.0 through 3.1.3 |
| CVE-2020-11996 | 7.5 | Jun 26 | A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several… Affected: 3.0; 3.1.3 |
| CVE-2013-3321 | 7.5 | Jan 29 | NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to the "diagnostic" page using the SnapMirror… Affected: through 2.1 |
| CVE-2016-3063 | 7.5 | Feb 7 | Multiple functions in NetApp OnCommand System Manager before 8.3.2 do not properly escape special characters, which allows remote authenticated users to execute arbitrary API… Affected: through 8.3.1 |
| CVE-2013-3322 | 7.2 | Jan 31 | NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to inject arbitrary commands in the Halt/Reboot interface Affected: through 2.1 |
| CVE-2019-12418 | 7.0 | Dec 23 | When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat… Affected: 3.0.0 through 3.1.3 |
| CVE-2016-5047 | 6.5 | Sep 1 | NetApp OnCommand System Manager 8.3.x before 8.3.2P5 allows remote authenticated users to cause a denial of service via unspecified vectors Affected: 8.3; 8.3.1; 8.3.2 |
| CVE-2020-7656 | 6.1 | May 19 | jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method Affected: 3.0.0 through 3.1.3 |
| CVE-2020-11022 | 6.1 | Apr 29 | In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e Affected: 3.0 through 3.1.3 |
| CVE-2013-3320 | 6.1 | Jan 29 | Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject arbitrary web script or HTML via the 'full-name' and… Affected: before 2.2 |
| CVE-2019-11358 | 6.1 | Apr 20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution Affected: 3.0 through 3.1.3 |
| CVE-2020-8587 | 5.5 | Feb 8 | OnCommand System Manager 9.x versions prior to 9.3P20 and 9.4 prior to 9.4P3 are susceptible to a vulnerability that could allow HTTP clients to cache sensitive responses making… Affected: 9.0 before 9.3; 9.3; 9.4 |
| CVE-2019-17276 | 5.4 | Mar 24 | OnCommand System Manager versions 9.3 prior to 9.3P18 and 9.4 prior to 9.4P2 are susceptible to a cross site scripting vulnerability that could allow an authenticated attacker to… Affected: 9.3; 9.4 |
| CVE-2019-10247 | 5.3 | Apr 22 | In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured… Affected: 3.0 through 3.1.3 |
| CVE-2019-10246 | 5.3 | Apr 22 | In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a… Affected: 3.0 through 3.1.3 |
| CVE-2020-27218 | 4.8 | Nov 28 | In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests… Affected: 3.0 through 3.1.3 |
| CVE-2019-17569 | 4.8 | Feb 24 | The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression Affected: 3.0.0 through 3.1.3 |
| CVE-2020-1935 | 4.8 | Feb 24 | In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP… Affected: 3.0.0 through 3.1.3 |
Showing 27