Summary
Detail | |||
---|---|---|---|
Vendor | Netapp | First view | 2017-07-24 |
Product | Oncommand Unified Manager | Last view | 2021-01-28 |
Version | - | Type | Application |
Update | * | ||
Edition | * | ||
Language | * | ||
Sofware Edition | * | ||
Target Software | clustered_data_ontap | ||
Target Hardware | * | ||
Other | * | ||
CPE Product | cpe:2.3:a:netapp:oncommand_unified_manager |
Activity : Overall
Related : CVE
Date | Alert | Description | |
---|---|---|---|
5.5 | 2021-01-28 | CVE-2020-8585 | OnCommand Unified Manager Core Package versions prior to 5.2.5 may disclose sensitive account information to unauthorized users via the use of PuTTY Link (plink). |
7.5 | 2019-05-10 | CVE-2019-5495 | OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors. |
7.5 | 2019-05-10 | CVE-2019-5494 | OnCommand Unified Manager 7-Mode prior to version 5.2.4 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors. |
4.9 | 2019-01-16 | CVE-2019-2539 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Connection). Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). |
4.9 | 2019-01-16 | CVE-2019-2537 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). |
5 | 2019-01-16 | CVE-2019-2536 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 8.0.13 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:H). |
4.1 | 2019-01-16 | CVE-2019-2535 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options). Supported versions that are affected are 8.0.13 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). |
7.1 | 2019-01-16 | CVE-2019-2534 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). |
6.5 | 2019-01-16 | CVE-2019-2533 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges). Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). |
2.5 | 2019-01-16 | CVE-2019-2513 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Shell). Supported versions that are affected are 8.0.13 and prior. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 2.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N). |
7.4 | 2019-01-07 | CVE-2018-5481 | OnCommand Unified Manager for 7-Mode (core package) prior to 5.2.4 uses cookies that lack the secure attribute in certain circumstances making it vulnerable to impersonation via man-in-the-middle (MITM) attacks. |
4.9 | 2018-10-16 | CVE-2018-3212 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Information Schema). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). |
6.5 | 2018-10-16 | CVE-2018-3203 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). |
6.5 | 2018-10-16 | CVE-2018-3145 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). |
9.8 | 2018-06-26 | CVE-2017-7657 | In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request. |
5.3 | 2018-06-22 | CVE-2017-7568 | NetApp OnCommand Unified Manager for 7-Mode (core package) versions prior to 5.2.3 may disclose sensitive LDAP account information to authenticated users when the LDAP authentication configuration is tested via the user interface. |
9.8 | 2018-05-24 | CVE-2018-5487 | NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution. |
7.8 | 2018-05-24 | CVE-2018-5485 | NetApp OnCommand Unified Manager for Windows versions 7.2 through 7.3 are susceptible to a vulnerability which could lead to a privilege escalation attack. |
7.8 | 2018-04-25 | CVE-2018-5486 | NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauthorized local attackers to execute arbitrary code. |
4.3 | 2017-11-09 | CVE-2017-11461 | NetApp OnCommand Unified Manager for 7-mode (core package) versions prior to 5.2.1 are susceptible to a clickjacking or "UI redress attack" which could be used to cause a user to perform an unintended action in the user interface. |
9.8 | 2017-08-07 | CVE-2015-7871 | Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication. |
6.5 | 2017-08-07 | CVE-2015-7855 | The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value. |
8.8 | 2017-08-07 | CVE-2015-7854 | Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted key file. |
9.8 | 2017-08-07 | CVE-2015-7853 | The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value. |
5.9 | 2017-08-07 | CVE-2015-7852 | ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets. |
CWE : Common Weakness Enumeration
% | id | Name |
---|---|---|
43% (10) | CWE-20 | Improper Input Validation |
8% (2) | CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflo... |
4% (1) | CWE-772 | Missing Release of Resource after Effective Lifetime |
4% (1) | CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggli... |
4% (1) | CWE-416 | Use After Free |
4% (1) | CWE-319 | Cleartext Transmission of Sensitive Information |
4% (1) | CWE-311 | Missing Encryption of Sensitive Data |
4% (1) | CWE-306 | Missing Authentication for Critical Function |
4% (1) | CWE-287 | Improper Authentication |
4% (1) | CWE-254 | Security Features |
4% (1) | CWE-200 | Information Exposure |
4% (1) | CWE-190 | Integer Overflow or Wraparound |
4% (1) | CWE-59 | Improper Link Resolution Before File Access ('Link Following') |
Snort® IPS/IDS
Date | Description |
---|---|
2016-12-20 | NTP origin timestamp denial of service attempt RuleID : 40811 - Type : SERVER-OTHER - Revision : 4 |
2016-03-14 | NTP arbitrary pidfile and driftfile overwrite attempt RuleID : 37526 - Type : SERVER-OTHER - Revision : 3 |
2016-03-14 | NTP arbitrary pidfile and driftfile overwrite attempt RuleID : 37525 - Type : SERVER-OTHER - Revision : 4 |
2016-03-14 | NTP decodenetnum assertion failure denial of service attempt RuleID : 36633 - Type : SERVER-OTHER - Revision : 3 |
2016-03-14 | NTP decodenetnum assertion failure denial of service attempt RuleID : 36632 - Type : SERVER-OTHER - Revision : 3 |
2016-03-14 | NTP crypto-NAK packet flood attempt RuleID : 36536 - Type : SERVER-OTHER - Revision : 5 |
2015-10-01 | ntpd remote configuration denial of service attempt RuleID : 36252 - Type : SERVER-OTHER - Revision : 4 |
2015-10-01 | ntpq atoascii memory corruption attempt RuleID : 36251 - Type : SERVER-OTHER - Revision : 4 |
2015-10-01 | ntpd keyfile buffer overflow attempt RuleID : 36250 - Type : SERVER-OTHER - Revision : 4 |
Nessus® Vulnerability Scanner
id | Description |
---|---|
2019-01-17 | Name: The remote database server is affected by multiple vulnerabilities. File: mysql_8_0_14.nasl - Type: ACT_GATHER_INFO |
2019-01-17 | Name: The remote database server is affected by multiple vulnerabilities. File: mysql_5_7_25.nasl - Type: ACT_GATHER_INFO |
2019-01-17 | Name: The remote database server is affected by multiple vulnerabilities. File: mysql_5_6_43.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-c82fc3e109.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-48b73ed393.nasl - Type: ACT_GATHER_INFO |
2018-10-22 | Name: The remote FreeBSD host is missing one or more security-related updates. File: freebsd_pkg_ec5072b0d43a11e8a6d2b499baebfeaf.nasl - Type: ACT_GATHER_INFO |
2018-10-19 | Name: The remote database server is affected by multiple vulnerabilities. File: mysql_8_0_13.nasl - Type: ACT_GATHER_INFO |
2018-08-20 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-4278.nasl - Type: ACT_GATHER_INFO |
2018-07-13 | Name: The remote Fedora host is missing a security update. File: fedora_2018-93a507fd0f.nasl - Type: ACT_GATHER_INFO |
2018-05-11 | Name: The remote Amazon Linux AMI host is missing a security update. File: ala_ALAS-2018-1009.nasl - Type: ACT_GATHER_INFO |
2018-05-11 | Name: The remote Amazon Linux 2 host is missing a security update. File: al2_ALAS-2018-1009.nasl - Type: ACT_GATHER_INFO |
2017-08-09 | Name: The remote AIX host has a version of NTP installed that is affected by multip... File: aix_ntp_v4_advisory4.nasl - Type: ACT_GATHER_INFO |
2017-08-09 | Name: The remote AIX host has a version of NTP installed that is affected by multip... File: aix_ntp_v3_advisory4.nasl - Type: ACT_GATHER_INFO |
2017-05-01 | Name: The remote EulerOS host is missing multiple security updates. File: EulerOS_SA-2016-1060.nasl - Type: ACT_GATHER_INFO |
2017-02-01 | Name: The remote host is affected by multiple vulnerabilities. File: citrix_xenserver_CTX220112.nasl - Type: ACT_GATHER_INFO |
2016-12-15 | Name: The remote Scientific Linux host is missing one or more security updates. File: sl_20161103_ntp_on_SL7_x.nasl - Type: ACT_GATHER_INFO |
2016-11-28 | Name: The remote CentOS host is missing one or more security updates. File: centos_RHSA-2016-2583.nasl - Type: ACT_GATHER_INFO |
2016-11-11 | Name: The remote Oracle Linux host is missing one or more security updates. File: oraclelinux_ELSA-2016-2583.nasl - Type: ACT_GATHER_INFO |
2016-11-04 | Name: The remote Red Hat host is missing one or more security updates. File: redhat-RHSA-2016-2583.nasl - Type: ACT_GATHER_INFO |
2016-08-29 | Name: The remote SUSE host is missing one or more security updates. File: suse_SU-2016-1912-1.nasl - Type: ACT_GATHER_INFO |
2016-07-21 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201607-15.nasl - Type: ACT_GATHER_INFO |
2016-06-17 | Name: The remote SUSE host is missing one or more security updates. File: suse_SU-2016-1568-1.nasl - Type: ACT_GATHER_INFO |
2016-06-09 | Name: The remote Scientific Linux host is missing one or more security updates. File: sl_20160510_ntp_on_SL6_x.nasl - Type: ACT_GATHER_INFO |
2016-06-03 | Name: The remote device is missing a vendor-supplied security patch. File: f5_bigip_SOL17528.nasl - Type: ACT_GATHER_INFO |
2016-06-01 | Name: The remote openSUSE host is missing a security update. File: openSUSE-2016-649.nasl - Type: ACT_GATHER_INFO |