Oncommand Unified Manager vulnerabilities | LiveThreat CVE Feed

Product

Oncommand Unified Manager

by Netapp · last CVE Jan 28, 2021

On CISA KEVExploited in the wild

169

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities169 In the news0 Timeline

Severity mix

Critical 26High 47Medium 85Low 11

Severity

All severities169 Critical26 High47 Medium85 Low11

Exploitation

On CISA KEV3 Exploited in the wild3

Watch

Add Oncommand Unified Manager to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2016-3427 In wildKEV	9.8	92%	Apr 21	Oracle Java SE and JRockit Unspecified Vulnerability Affected: All versions, or not specified
CVE-2019-5482	9.8	18%	Sep 16	Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3 Affected: 7.3 and later; 9.5 and later
CVE-2019-9898	9.8	4%	Mar 21	Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71 Affected: All versions, or not specified
CVE-2017-7657	9.8	15%	Jun 26	In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled… Affected: before 5.2.4
CVE-2018-5487	9.8	3%	May 24	NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and… Affected: 7.2 through 7.3
CVE-2018-8014	9.8	21%	May 16	The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable… Affected: 9.4 and later; 7.3 and later
CVE-2015-7871	9.8	82%	Aug 7	Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication Affected: All versions, or not specified
CVE-2015-7853	9.8	12%	Aug 7	The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service… Affected: All versions, or not specified
CVE-2015-7705	9.8	12%	Aug 7	The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests Affected: All versions, or not specified
CVE-2017-3167	9.8	20%	Jun 20	In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to… Affected: All versions, or not specified
CVE-2016-9841	9.8	8%	May 23	inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic Affected: through 7.1; through 7.1
CVE-2017-10346	9.6	3%	Oct 19	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: through 7.1; through 7.1
CVE-2017-10285	9.6	3%	Oct 19	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: through 7.1; through 7.1
CVE-2017-10111	9.6	2%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: through 7.1; through 7.1
CVE-2017-10110	9.6	2%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT) Affected: through 7.1; through 7.1
CVE-2017-10107	9.6	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: through 7.1; through 7.1
CVE-2017-10101	9.6	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) Affected: through 7.1; through 7.1
CVE-2017-10096	9.6	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) Affected: through 7.1; through 7.1
CVE-2017-10090	9.6	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: through 7.1; through 7.1
CVE-2017-10089	9.6	2%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: ImageIO) Affected: through 7.1; through 7.1
CVE-2017-10087	9.6	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: through 7.1; through 7.1
CVE-2017-10086	9.6	2%	Aug 8	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX) Affected: 7.1 and later; 7.1 and later
CVE-2018-10933	9.1	92%	Oct 17	A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4 Affected: 7.3 and later; 9.4 and later
CVE-2017-9788	9.1	57%	Jul 13	In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between… Affected: All versions, or not specified
CVE-2018-2938	9.0	2%	Jul 18	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Java DB) Affected: All versions, or not specified
CVE-2017-10102	9.0	3%	Aug 8	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: through 7.1; through 7.1