Netapp Ontap 9 — known CVE vulnerabilities

Every CVE whose affected-product data names Netapp Ontap 9, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (7)

• CVE-2024-38475 — CVSS 9.1 (critical) — actively exploited: Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations…
• CVE-2022-42915 — CVSS 8.1 (high): curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection…
• CVE-2024-26461 — CVSS 7.5 (high): Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
• CVE-2024-53580 — CVSS 7.5 (high): iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function.
• CVE-2024-6119 — CVSS 7.5 (high): Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an…
• CVE-2023-27535 — CVSS 5.9 (medium): An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials…
• CVE-2024-26458 — CVSS 5.3 (medium): Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.