Solidfire, Enterprise Sds & Hci Storage Node vulnerabilities

7 known vulnerabilities in Solidfire, Enterprise Sds & Hci Storage Node from NetApp. 7 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  https://github.com/curl/curl: Loop with Unreachable Exit Condition

  CVE-2022-27781Jun 2, 2022Https://github.com/curl/curlEPSS 2.9%

  libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop whe

• 7.5 High severity

  https://github.com/curl/curl: Server-Side Request Forgery

  CVE-2022-27780Jun 2, 2022Https://github.com/curl/curlEPSS 2.52%

  The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, wou

• 7.8 High severity

  Linux Kernel: Missing Authorization

  CVE-2022-30594May 12, 2022Linux

  The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.

• 7.5 High severity

  OpenSSL: Incomplete Cleanup

  CVE-2022-1473May 3, 2022OpenSSLEPSS 4.68%

  The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes cert

• 7.3 High severity

  OpenSSL: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-1292May 3, 2022OpenSSLEPSS 82.6%

  The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrar

• 7.8 High severity

  Linux Kernel Improper Authentication Exploited

  CVE-2022-0492Mar 3, 2022KernelEPSS 5.53%

  A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace

• 7.5 High severity

  python: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2022-0391Feb 9, 2022PythonEPSS 8.54%

  A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n'