SnapCenter vulnerabilities

14 known vulnerabilities in SnapCenter from NetApp. 14 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  SnapCenter: Incorrect Privilege Assignment

  CVE-2025-26512Mar 24, 2025NetApp

  SnapCenter versions prior to 6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a remote system where a SnapCenter plug-in has been installed.

• 9.1 Critical severity

  OpenSSL: Out-of-bounds Read

  CVE-2024-5535Jun 27, 2024OpenSSLEPSS 6.13%

  Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such

• 7.3 High severity

  Apache Commons Configuration: Out-of-bounds Write

  CVE-2024-29131Mar 21, 2024ApacheEPSS 2.05%

  Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.

• 7.8 High severity

  SnapCenter: Improper Privilege Management

  CVE-2023-27316Oct 12, 2023NetApp

  SnapCenter versions 4.8 through 4.9 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a remote system where a SnapCenter plug-in has been installed.

• 8.8 High severity

  SnapCenter: Execution with Unnecessary Privileges

  CVE-2023-27313Oct 12, 2023NetApp

  SnapCenter versions 3.x and 4.x prior to 4.9 are susceptible to a vulnerability which may allow an authenticated unprivileged user to gain access as an admin user.

• 7.5 High severity

  https://github.com/curl/curl: Cleartext Transmission of Sensitive Information

  CVE-2022-43551Dec 23, 2022Https://github.com/curl/curlEPSS 16.6%

  A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. Howeve

• 7.5 High severity

  Eclipse Jetty: Insufficient Resource Pool

  CVE-2022-2048Jul 7, 2022Eclipse FoundationEPSS 2.56%

  In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario wh

• 9.8 Critical severity

  OpenSSL: Out-of-bounds Write

  CVE-2022-2274Jul 1, 2022OpenSSLEPSS 48.2%

  The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen

• 8.1 High severity

  https://github.com/curl/curl: Use of Incorrectly-Resolved Name or Reference

  CVE-2022-27778Jun 2, 2022Https://github.com/curl/curlEPSS 3.81%

  A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.

• 7.3 High severity

  OpenSSL: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-1292May 3, 2022OpenSSLEPSS 82.6%

  The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrar

• 8.2 High severity

  Node: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2022-21824Feb 24, 2022Node.jsEPSS 21.5%

  Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could b

• 10.0 Critical severity

  Apache Log4j2 Remote Code Execution Exploited

  CVE-2021-44228Dec 10, 2021ApacheEPSS 100%

  Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who c

• 8.1 High severity

  Apache Struts Remote Code Execution Exploited

  CVE-2018-11776Aug 22, 2018ApacheEPSS 100%

  Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its uppe

• 8.1 High severity

  Apache Tomcat Remote Code Execution Exploited

  CVE-2017-12617Oct 4, 2017ApacheEPSS 100%

  When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file