Oncommand Unified Manager vulnerabilities | LiveThreat CVE Feed

Product

Oncommand Unified Manager

by Netapp · last CVE Jan 28, 2021

On CISA KEVExploited in the wild

169

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities169 In the news0 Timeline

Severity mix

Critical 26High 47Medium 85Low 11

Severity

All severities169 Critical26 High47 Medium85 Low11

Exploitation

On CISA KEV3 Exploited in the wild3

Watch

Add Oncommand Unified Manager to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2016-3427 In wildKEV	9.8	92%	Apr 21	Oracle Java SE and JRockit Unspecified Vulnerability Affected: All versions, or not specified
CVE-2010-1871 In wildKEV	8.8	83%	Aug 4	Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability Affected: All versions, or not specified
CVE-2019-0211 In wildKEV	7.8	65%	Apr 8	Apache HTTP Server Privilege Escalation Vulnerability Affected: All versions, or not specified
CVE-2019-5482	9.8	18%	Sep 16	Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3 Affected: 7.3 and later; 9.5 and later
CVE-2019-9898	9.8	4%	Mar 21	Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71 Affected: All versions, or not specified
CVE-2017-7657	9.8	15%	Jun 26	In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled… Affected: before 5.2.4
CVE-2018-5487	9.8	3%	May 24	NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and… Affected: 7.2 through 7.3
CVE-2018-8014	9.8	21%	May 16	The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable… Affected: 9.4 and later; 7.3 and later
CVE-2015-7871	9.8	82%	Aug 7	Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication Affected: All versions, or not specified
CVE-2015-7853	9.8	12%	Aug 7	The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service… Affected: All versions, or not specified
CVE-2015-7705	9.8	12%	Aug 7	The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests Affected: All versions, or not specified
CVE-2017-3167	9.8	20%	Jun 20	In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to… Affected: All versions, or not specified
CVE-2016-9841	9.8	8%	May 23	inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic Affected: through 7.1; through 7.1
CVE-2017-10346	9.6	3%	Oct 19	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: through 7.1; through 7.1
CVE-2017-10285	9.6	3%	Oct 19	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: through 7.1; through 7.1
CVE-2017-10111	9.6	2%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: through 7.1; through 7.1
CVE-2017-10110	9.6	2%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT) Affected: through 7.1; through 7.1
CVE-2017-10107	9.6	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: through 7.1; through 7.1
CVE-2017-10101	9.6	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) Affected: through 7.1; through 7.1
CVE-2017-10096	9.6	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) Affected: through 7.1; through 7.1
CVE-2017-10090	9.6	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: through 7.1; through 7.1
CVE-2017-10089	9.6	2%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: ImageIO) Affected: through 7.1; through 7.1
CVE-2017-10087	9.6	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: through 7.1; through 7.1
CVE-2017-10086	9.6	2%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX) Affected: 7.1 and later; 7.1 and later
CVE-2018-10933	9.1	92%	Oct 17	A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4 Affected: 7.3 and later; 9.4 and later
CVE-2017-9788	9.1	57%	Jul 13	In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between… Affected: All versions, or not specified
CVE-2018-2938	9.0	2%	Jul 18	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Java DB) Affected: All versions, or not specified
CVE-2017-10102	9.0	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: through 7.1; through 7.1
CVE-2018-12538	8.8	3%	Jun 22	In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a… Affected: All versions, or not specified
CVE-2018-1258	8.8	2%	May 11	Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security Affected: 7.3 and later; 9.4 and later
CVE-2015-7854	8.8	15%	Aug 7	Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service… Affected: All versions, or not specified
CVE-2015-7849	8.8	17%	Aug 7	Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code or cause a denial of… Affected: All versions, or not specified
CVE-2018-2964	8.3	3%	Jul 18	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment) Affected: All versions, or not specified
CVE-2018-2942	8.3	2%	Jul 18	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Windows DLL) Affected: All versions, or not specified
CVE-2018-2941	8.3	3%	Jul 18	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX) Affected: All versions, or not specified
CVE-2018-2826	8.3	5%	Apr 19	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries) Affected: 7.3 and later; 9.4 and later; 7.3
CVE-2018-2825	8.3	4%	Apr 19	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries) Affected: 7.3 and later; 9.4 and later; 7.3
CVE-2018-2638	8.3	3%	Jan 18	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment) Affected: All versions, or not specified
CVE-2017-10116	8.3	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security) Affected: through 7.1; through 7.1
CVE-2017-10114	8.3	2%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX) Affected: through 7.1; through 7.1
CVE-2017-10074	8.3	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: through 7.1; through 7.1
CVE-2017-10078	8.1	2%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting) Affected: through 7.1; through 7.1
CVE-2019-18276	7.8	3%	Nov 28	An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11 Affected: 9.5 and later
CVE-2019-5443	7.8	1%	Jul 2	A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as… Affected: 7.3 and later; 9.5 and later
CVE-2018-5485	7.8	0%	May 24	NetApp OnCommand Unified Manager for Windows versions 7.2 through 7.3 are susceptible to a vulnerability which could lead to a privilege escalation attack Affected: 7.2 through 7.3
CVE-2018-5486	7.8	0%	Apr 25	NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauthorized local attackers to execute… Affected: 7.2 through 7.3
CVE-2018-3155	7.7	4%	Oct 17	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser) Affected: 9.4 and later; 7.3 and later
CVE-2019-5495	7.5	1%	May 10	OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain… Affected: before 9.5; before 9.5; before 9.5
CVE-2019-5494	7.5	1%	May 10	OnCommand Unified Manager 7-Mode prior to version 5.2.4 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via… Affected: before 5.2.4
CVE-2019-0217	7.5	17%	Apr 8	In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate… Affected: All versions, or not specified