[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVn7xxPSrGm4n8CXpc-fpeUAKyydXRwb_-1W-A4cOaUA":3,"g5a-family:netapp\u002F500f_firmware":103,"g5a-ex:netapp\u002F500f_firmware@*":104},{"success":4,"data":5},true,{"product":6,"versions":15,"topVulnerabilitiesByEpss":16,"kevVulnerabilities":75,"seoMetadata":81,"meta":100},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":14},"netapp","500f_firmware",0,13,1,"2024-09-03",[],"500f Firmware by Netapp is a technology product and 13 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[],[17,26,33,39,43,48,53,59,64,70],{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":24,"epssScore":25},"CVE-2024-6387","A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","2024-07-01",8.1,"v3.1","High",false,0.99506,{"cveId":27,"description":28,"publishedDate":29,"cvssScore":30,"cvssVersion":22,"severity":31,"isKev":24,"epssScore":32},"CVE-2023-25136","OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states \"remote code execution is theoretically possible.\"","2023-02-03",6.5,"Medium",0.89685,{"cveId":34,"description":35,"publishedDate":36,"cvssScore":37,"cvssVersion":22,"severity":23,"isKev":24,"epssScore":38},"CVE-2022-0778","The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).","2022-03-15",7.5,0.73188,{"cveId":40,"description":41,"publishedDate":12,"cvssScore":37,"cvssVersion":22,"severity":23,"isKev":24,"epssScore":42},"CVE-2024-6119","Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic certificate chain validation (signatures, dates, ...) is not\naffected, the denial of service can occur only when the application also\nspecifies an expected DNS name, Email address or IP address.\n\nTLS servers rarely solicit client certificates, and even when they do, they\ngenerally don't perform a name check against a reference identifier (expected\nidentity), but rather extract the presented identity after checking the\ncertificate chain.  So TLS servers are generally not affected and the severity\nof the issue is Moderate.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.",0.66582,{"cveId":44,"description":45,"publishedDate":46,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":24,"epssScore":47},"CVE-2020-8625","BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch","2021-02-17",0.64161,{"cveId":49,"description":50,"publishedDate":51,"cvssScore":37,"cvssVersion":22,"severity":23,"isKev":24,"epssScore":52},"CVE-2021-4044","Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned by OpenSSL if the application has previously called SSL_CTX_set_cert_verify_callback(). Since most applications do not do this the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be totally unexpected and applications may not behave correctly as a result. The exact behaviour will depend on the application but it could result in crashes, infinite loops or other similar incorrect responses. This issue is made more serious in combination with a separate bug in OpenSSL 3.0 that will cause X509_verify_cert() to indicate an internal error when processing a certificate chain. This will occur where a certificate does not include the Subject Alternative Name extension but where a Certificate Authority has enforced name constraints. This issue can occur even with valid chains. By combining the two issues an attacker could induce incorrect, application dependent behaviour. Fixed in OpenSSL 3.0.1 (Affected 3.0.0).","2021-12-14",0.50099,{"cveId":54,"description":55,"publishedDate":56,"cvssScore":57,"cvssVersion":22,"severity":23,"isKev":4,"epssScore":58},"CVE-2024-1086","A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.\n\n\n\nThe nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.\n\n\n\nWe recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.","2024-01-31",7.8,0.28058,{"cveId":60,"description":61,"publishedDate":62,"cvssScore":37,"cvssVersion":22,"severity":23,"isKev":24,"epssScore":63},"CVE-2021-25215","In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.","2021-04-29",0.11387,{"cveId":65,"description":66,"publishedDate":67,"cvssScore":68,"cvssVersion":22,"severity":31,"isKev":24,"epssScore":69},"CVE-2019-25013","The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.","2021-01-04",5.9,0.03565,{"cveId":71,"description":72,"publishedDate":62,"cvssScore":73,"cvssVersion":22,"severity":31,"isKev":24,"epssScore":74},"CVE-2021-31879","GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.",6.1,0.01104,[76],{"cveId":54,"description":55,"publishedDate":56,"cvssScore":57,"severity":23,"isKev":4,"epssScore":58,"cisaVulnName":77,"cisaDateAdded":78,"cisaShortDescription":79,"cisaRequiredAction":80},"Linux Kernel Use-After-Free Vulnerability","2024-05-30","Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"title":82,"metaDescription":83,"keywords":84,"structuredData":85},"500f Firmware by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for 500f Firmware by Netapp with 13 tracked vulnerabilities including 0 critical and 1 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","500f Firmware vulnerabilities, 500f Firmware security, 500f Firmware CVE, Netapp 500f Firmware, 500f Firmware threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, 500f Firmware KEV, 500f Firmware exploited vulnerabilities",{"@context":86,"@type":87,"name":88,"description":83,"url":89,"manufacturer":90,"applicationCategory":94,"softwareVersion":95,"mainEntity":96},"https:\u002F\u002Fschema.org","SoftwareApplication","500f Firmware","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002F500f_firmware",{"@type":91,"name":92,"url":93},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","Multiple versions",{"@type":97,"name":98,"description":99,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","500f Firmware Security Vulnerabilities","Security vulnerabilities affecting 500f Firmware by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":101,"apiVersion":102},"2026-10-17T12:38:24.130Z","3.0",[],{"rows":105,"total":11,"capped":24,"failed":9},[106],{"cveId":54,"name":77,"severity":23,"cvss":57,"added":78,"epss":58,"published":107,"ranges":108,"checked":4,"hits":109,"covers":24},"2024-01-31T13:15:10.827",[],[]]