Oncommand Unified Manager vulnerabilities | LiveThreat CVE Feed

Product

Oncommand Unified Manager

by Netapp · last CVE Jan 28, 2021

On CISA KEVExploited in the wild

169

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities169 In the news0 Timeline

Severity mix

Critical 26High 47Medium 85Low 11

Severity

All severities169 Critical26 High47 Medium85 Low11

Exploitation

On CISA KEV3 Exploited in the wild3

Watch

Add Oncommand Unified Manager to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2019-9897	7.5	3%	Mar 21	Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71 Affected: All versions, or not specified
CVE-2019-9894	7.5	2%	Mar 21	A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification Affected: All versions, or not specified
CVE-2016-10708	7.5	16%	Jan 21	sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated… Affected: 9.4 and later
CVE-2018-2627	7.5	0%	Jan 18	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Installer) Affected: All versions, or not specified
CVE-2016-8610	7.5	40%	Nov 13	A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection… Affected: All versions, or not specified
CVE-2017-10388	7.5	3%	Oct 19	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: through 7.1; through 7.1
CVE-2017-10176	7.5	5%	Aug 8	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security) Affected: through 7.1; through 7.1
CVE-2017-10118	7.5	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE) Affected: through 7.1; through 7.1
CVE-2017-10115	7.5	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE) Affected: through 7.1; through 7.1
CVE-2017-10067	7.5	3%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security) Affected: through 7.1; through 7.1
CVE-2015-7704	7.5	11%	Aug 7	The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages Affected: All versions, or not specified
CVE-2015-7701	7.5	7%	Aug 7	Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption) Affected: All versions, or not specified
CVE-2015-7692	7.5	7%	Aug 7	The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) Affected: All versions, or not specified
CVE-2015-7691	7.5	7%	Aug 7	The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing… Affected: All versions, or not specified
CVE-2016-8743	7.5	13%	Jul 27	Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers Affected: All versions, or not specified
CVE-2015-7703	7.5	4%	Jul 24	The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers… Affected: All versions, or not specified
CVE-2017-7668	7.5	57%	Jun 20	The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input… Affected: All versions, or not specified
CVE-2015-7848	7.5	6%	Jan 6	An integer overflow can occur in NTP-dev.4.3.70 leading to an out-of-bounds memory copy operation when processing a specially crafted private mode packet Affected: All versions, or not specified
CVE-2018-5481	7.4	1%	Jan 7	OnCommand Unified Manager for 7-Mode (core package) prior to 5.2.4 uses cookies that lack the secure attribute in certain circumstances making it vulnerable to impersonation via… Affected: before 5.2.4
CVE-2019-2534	7.1	2%	Jan 16	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication) Affected: 7.3 through 9.5; 7.3 through 9.5
CVE-2017-10309	7.1	9%	Oct 19	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment) Affected: through 7.1; through 7.1
CVE-2017-10125	7.1	1%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment) Affected: through 7.1; through 7.1
CVE-2016-10165	7.1	3%	Feb 3	The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted… Affected: 7.1
CVE-2017-10274	6.8	3%	Oct 19	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Smart Card IO) Affected: through 7.1; through 7.1
CVE-2017-10198	6.8	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security) Affected: through 7.1; through 7.1
CVE-2019-2434	6.5	3%	Jan 16	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser) Affected: 7.3 and later; 9.4 and later
CVE-2019-2529	6.5	4%	Jan 16	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 7.3 and later; 9.4 and later
CVE-2019-2533	6.5	2%	Jan 16	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges) Affected: 7.3 through 9.5; 7.3 through 9.5
CVE-2018-3251	6.5	3%	Oct 17	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 9.4 and later; 7.3 and later
CVE-2018-3203	6.5	2%	Oct 17	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 7.3 through 9.5; 7.3 through 9.5
CVE-2018-3182	6.5	2%	Oct 17	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML) Affected: 7.3 and later; 9.4 and later
CVE-2018-3156	6.5	4%	Oct 17	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 9.4 and later; 7.3 and later
CVE-2018-3145	6.5	2%	Oct 17	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser) Affected: 7.3 through 9.5; 7.3 through 9.5
CVE-2018-3143	6.5	4%	Oct 17	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 9.4 and later; 7.3 and later
CVE-2018-3137	6.5	2%	Oct 17	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 9.4 and later; 7.3 and later
CVE-2018-3133	6.5	3%	Oct 17	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser) Affected: 9.4 and later
CVE-2018-11212	6.5	5%	May 16	An issue was discovered in libjpeg 9a and 9d Affected: 7.3 and later; 9.4 and later
CVE-2017-10384	6.5	3%	Oct 19	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) Affected: through 7.1; through 7.1
CVE-2017-10379	6.5	2%	Oct 19	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs) Affected: through 7.1; through 7.1
CVE-2017-10378	6.5	3%	Oct 19	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: through 7.1; through 7.1
CVE-2017-10243	6.5	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAX-WS) Affected: through 7.1; through 7.1
CVE-2015-7855	6.5	31%	Aug 7	The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7… Affected: All versions, or not specified
CVE-2015-7850	6.5	6%	Aug 7	ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing the key file at the… Affected: All versions, or not specified
CVE-2015-7702	6.5	5%	Aug 7	The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) Affected: All versions, or not specified
CVE-2017-10356	6.2	1%	Oct 19	Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security) Affected: through 7.1; through 7.1
CVE-2017-10293	6.1	1%	Oct 19	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Javadoc) Affected: through 7.1; through 7.1
CVE-2019-1559	5.9	17%	Feb 27	0-byte record padding oracle Affected: All versions, or not specified
CVE-2018-0734	5.9	12%	Oct 30	Timing attack against DSA Affected: All versions, or not specified
CVE-2018-0735	5.9	5%	Oct 29	Timing attack against ECDSA signature generation Affected: 9.4 and later
CVE-2018-3144	5.9	4%	Oct 17	Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Audit) Affected: 9.4 and later; 7.3 and later