[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsG9_-ZqqaBXgRNd05Qh71z9nOPxFAo_cLyy004J99UY":3,"g5a-family:netapp\u002Fbootstrap_os":104,"g5a-ex:netapp\u002Fbootstrap_os@*":105},{"success":4,"data":5},true,{"product":6,"versions":15,"topVulnerabilitiesByEpss":16,"kevVulnerabilities":76,"seoMetadata":82,"meta":101},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":14},"netapp","bootstrap_os",0,36,1,"2025-03-13",[],"Bootstrap Os by Netapp is a technology product and 36 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[],[17,25,33,39,45,52,57,61,66,71],{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":4,"epssScore":24},"CVE-2025-24813","Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and\u002For Information disclosure and\u002For malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and\u002For inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to       perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","2025-03-10",9.8,"v3.1","Critical",0.99927,{"cveId":26,"description":27,"publishedDate":28,"cvssScore":29,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":32},"CVE-2024-6387","A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","2024-07-01",8.1,"High",false,0.99506,{"cveId":34,"description":35,"publishedDate":36,"cvssScore":37,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":38},"CVE-2022-2068","In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).","2022-06-21",7.3,0.96391,{"cveId":40,"description":41,"publishedDate":42,"cvssScore":43,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":44},"CVE-2024-6119","Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic certificate chain validation (signatures, dates, ...) is not\naffected, the denial of service can occur only when the application also\nspecifies an expected DNS name, Email address or IP address.\n\nTLS servers rarely solicit client certificates, and even when they do, they\ngenerally don't perform a name check against a reference identifier (expected\nidentity), but rather extract the presented identity after checking the\ncertificate chain.  So TLS servers are generally not affected and the severity\nof the issue is Moderate.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.","2024-09-03",7.5,0.66582,{"cveId":46,"description":47,"publishedDate":48,"cvssScore":49,"cvssVersion":22,"severity":50,"isKev":31,"epssScore":51},"CVE-2022-32206","curl \u003C 7.84.0 supports \"chained\" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable \"links\" in this \"decompression chain\" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a \"malloc bomb\", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.","2022-07-07",6.5,"Medium",0.36348,{"cveId":53,"description":54,"publishedDate":55,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":31,"epssScore":56},"CVE-2024-50379","Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.","2024-12-17",0.31824,{"cveId":58,"description":59,"publishedDate":48,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":31,"epssScore":60},"CVE-2022-32207","When curl \u003C 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.",0.12321,{"cveId":62,"description":63,"publishedDate":64,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":31,"epssScore":65},"CVE-2024-56337","Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nThe mitigation for CVE-2024-50379 was incomplete.\n\nUsers running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation \nparameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:\n- running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true)\n- running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false)\n- running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed)\n\nTomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.","2024-12-20",0.08969,{"cveId":67,"description":68,"publishedDate":48,"cvssScore":69,"cvssVersion":22,"severity":50,"isKev":31,"epssScore":70},"CVE-2022-32208","When curl \u003C 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.",5.9,0.08373,{"cveId":72,"description":73,"publishedDate":74,"cvssScore":49,"cvssVersion":22,"severity":50,"isKev":31,"epssScore":75},"CVE-2020-13143","gadget_dev_desc_UDC_store in drivers\u002Fusb\u002Fgadget\u002Fconfigfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4.","2020-05-18",0.05193,[77],{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"severity":23,"isKev":4,"epssScore":24,"cisaVulnName":78,"cisaDateAdded":79,"cisaShortDescription":80,"cisaRequiredAction":81},"Apache Tomcat Path Equivalence Vulnerability","2025-04-01","Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"title":83,"metaDescription":84,"keywords":85,"structuredData":86},"Bootstrap Os by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Bootstrap Os by Netapp with 36 tracked vulnerabilities including 1 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Bootstrap Os vulnerabilities, Bootstrap Os security, Bootstrap Os CVE, Netapp Bootstrap Os, Bootstrap Os threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Bootstrap Os KEV, Bootstrap Os exploited vulnerabilities",{"@context":87,"@type":88,"name":89,"description":84,"url":90,"manufacturer":91,"applicationCategory":95,"softwareVersion":96,"mainEntity":97},"https:\u002F\u002Fschema.org","SoftwareApplication","Bootstrap Os","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Fbootstrap_os",{"@type":92,"name":93,"url":94},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","Multiple versions",{"@type":98,"name":99,"description":100,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Bootstrap Os Security Vulnerabilities","Security vulnerabilities affecting Bootstrap Os by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":102,"apiVersion":103},"2026-10-17T14:25:24.972Z","3.0",[],{"rows":106,"total":11,"capped":31,"failed":9},[107],{"cveId":18,"name":78,"severity":23,"cvss":21,"added":79,"epss":24,"published":108,"ranges":109,"checked":4,"hits":110,"covers":31},"2025-03-10T17:15:35.067",[],[]]