Smi-s Provider vulnerabilities

6 known vulnerabilities in Smi-s Provider from NetApp. 6 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Service Location Protocol (SLP) Denial-of-Service Exploited

  CVE-2023-29552Apr 25, 2023NetAppEPSS 64%

  The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

• 7.5 High severity

  OpenSSL: Improper Locking

  CVE-2022-3996Dec 13, 2022OpenSSLEPSS 1.31%

  If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process h

• 7.8 High severity

  SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Double Free

  CVE-2022-40304Nov 23, 2022SiemensEPSS 5.81%

  An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

• 7.3 High severity

  OpenSSL: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-2068Jun 21, 2022OpenSSLEPSS 96.4%

  In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was

• 7.5 High severity

  OpenSSL: Incomplete Cleanup

  CVE-2022-1473May 3, 2022OpenSSLEPSS 4.68%

  The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes cert

• 7.3 High severity

  OpenSSL: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-1292May 3, 2022OpenSSLEPSS 82.6%

  The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrar