Hci Compute Node vulnerabilities

12 known vulnerabilities in Hci Compute Node from NetApp. 12 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  vim: Improper Neutralization of Special Elements used in a Command

  CVE-2025-27423Mar 3, 2025VimEPSS 22.5%

  Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append b

• 7.7 High severity

  libxml2: Stack-based Buffer Overflow

  CVE-2025-24928Feb 18, 2025Xmlsoft

  libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.

• 9.8 Critical severity

  libxml2: Use After Free

  CVE-2024-56171Feb 18, 2025XmlsoftEPSS 1.18%

  libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constrain

• 9.1 Critical severity

  libxml2: Improper Restriction of XML External Entity Reference

  CVE-2024-40896Dec 23, 2024Libxml2EPSS 1.22%

  In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

• 7.3 High severity

  glibc: Out-of-bounds Write

  CVE-2024-2961Apr 17, 2024The GNU C LibraryEPSS 88.3%

  The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring v

• 9.8 Critical severity

  SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Out-of-bounds Write

  CVE-2022-37434Aug 5, 2022SiemensEPSS 19.2%

  zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code

• 7.5 High severity

  Apache Xalan-J: Incorrect Conversion between Numeric Types

  CVE-2022-34169Jul 19, 2022ApacheEPSS 81.8%

  The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are rec

• 7.5 High severity

  Eclipse Jetty: Insufficient Resource Pool

  CVE-2022-2048Jul 7, 2022Eclipse FoundationEPSS 2.56%

  In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario wh

• 7.5 High severity

  https://github.com/curl/curl: Loop with Unreachable Exit Condition

  CVE-2022-27781Jun 2, 2022Https://github.com/curl/curlEPSS 2.9%

  libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop whe

• 7.8 High severity

  Linux Kernel: Missing Authorization

  CVE-2022-30594May 12, 2022Linux

  The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.

• 7.5 High severity

  python: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2022-0391Feb 9, 2022PythonEPSS 8.54%

  A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n'

• 7.8 High severity

  Linux Kernel Improper Privilege Management Exploited

  CVE-2019-13272Jul 17, 2019LinuxEPSS 52.2%

  In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-