[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcMtNA4XVLeR8jH97UpAaQDGKJOfH9Ir-_q7mpNBUYUQ":3,"g5a-family:netapp\u002Fe-series_performance_analyzer":104,"g5a-ex:netapp\u002Fe-series_performance_analyzer@*":105},{"success":4,"data":5},true,{"product":6,"versions":15,"topVulnerabilitiesByEpss":16,"kevVulnerabilities":76,"seoMetadata":82,"meta":101},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":14},"netapp","e-series_performance_analyzer",0,61,1,"2022-12-07",[],"E-series Performance Analyzer by Netapp is a technology product and 61 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[],[17,26,32,39,44,50,56,60,65,71],{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":24,"epssScore":25},"CVE-2020-13379","The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user\u002Fclient to make Grafana send HTTP requests to any URL and return its result to the user\u002Fclient. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.","2020-06-03",8.2,"v3.1","High",false,0.99856,{"cveId":27,"description":28,"publishedDate":29,"cvssScore":30,"cvssVersion":22,"severity":23,"isKev":24,"epssScore":31},"CVE-2021-27358","The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.","2021-03-18",7.5,0.83042,{"cveId":33,"description":34,"publishedDate":35,"cvssScore":36,"cvssVersion":22,"severity":37,"isKev":24,"epssScore":38},"CVE-2021-28164","In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to \u002Fcontext\u002F%2e\u002FWEB-INF\u002Fweb.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.","2021-04-01",5.3,"Medium",0.82371,{"cveId":40,"description":41,"publishedDate":42,"cvssScore":30,"cvssVersion":22,"severity":23,"isKev":24,"epssScore":43},"CVE-2021-22883","Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.","2021-03-03",0.77385,{"cveId":45,"description":46,"publishedDate":47,"cvssScore":48,"cvssVersion":22,"severity":23,"isKev":24,"epssScore":49},"CVE-2022-31097","Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.","2022-07-15",8.7,0.7006,{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":22,"severity":37,"isKev":24,"epssScore":55},"CVE-2021-3449","An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).","2021-03-25",5.9,0.63542,{"cveId":57,"description":58,"publishedDate":35,"cvssScore":30,"cvssVersion":22,"severity":23,"isKev":24,"epssScore":59},"CVE-2021-28165","In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.",0.53861,{"cveId":61,"description":62,"publishedDate":63,"cvssScore":30,"cvssVersion":22,"severity":23,"isKev":24,"epssScore":64},"CVE-2020-1967","Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).","2020-04-21",0.53336,{"cveId":66,"description":67,"publishedDate":68,"cvssScore":69,"cvssVersion":22,"severity":23,"isKev":4,"epssScore":70},"CVE-2019-13272","In the Linux kernel before 5.1.17, ptrace_link in kernel\u002Fptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.","2019-07-17",7.8,0.52199,{"cveId":72,"description":73,"publishedDate":74,"cvssScore":30,"cvssVersion":22,"severity":23,"isKev":24,"epssScore":75},"CVE-2021-4044","Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned by OpenSSL if the application has previously called SSL_CTX_set_cert_verify_callback(). Since most applications do not do this the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be totally unexpected and applications may not behave correctly as a result. The exact behaviour will depend on the application but it could result in crashes, infinite loops or other similar incorrect responses. This issue is made more serious in combination with a separate bug in OpenSSL 3.0 that will cause X509_verify_cert() to indicate an internal error when processing a certificate chain. This will occur where a certificate does not include the Subject Alternative Name extension but where a Certificate Authority has enforced name constraints. This issue can occur even with valid chains. By combining the two issues an attacker could induce incorrect, application dependent behaviour. Fixed in OpenSSL 3.0.1 (Affected 3.0.0).","2021-12-14",0.50099,[77],{"cveId":66,"description":67,"publishedDate":68,"cvssScore":69,"severity":23,"isKev":4,"epssScore":70,"cisaVulnName":78,"cisaDateAdded":79,"cisaShortDescription":80,"cisaRequiredAction":81},"Linux Kernel Improper Privilege Management Vulnerability","2021-12-10","Kernel\u002Fptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.","Apply updates per vendor instructions.",{"title":83,"metaDescription":84,"keywords":85,"structuredData":86},"E-series Performance Analyzer by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for E-series Performance Analyzer by Netapp with 61 tracked vulnerabilities including 0 critical and 1 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","E-series Performance Analyzer vulnerabilities, E-series Performance Analyzer security, E-series Performance Analyzer CVE, Netapp E-series Performance Analyzer, E-series Performance Analyzer threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, E-series Performance Analyzer KEV, E-series Performance Analyzer exploited vulnerabilities",{"@context":87,"@type":88,"name":89,"description":84,"url":90,"manufacturer":91,"applicationCategory":95,"softwareVersion":96,"mainEntity":97},"https:\u002F\u002Fschema.org","SoftwareApplication","E-series Performance Analyzer","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Fe-series_performance_analyzer",{"@type":92,"name":93,"url":94},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","Multiple versions",{"@type":98,"name":99,"description":100,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","E-series Performance Analyzer Security Vulnerabilities","Security vulnerabilities affecting E-series Performance Analyzer by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":102,"apiVersion":103},"2026-10-17T19:54:19.644Z","3.0",[],{"rows":106,"total":11,"capped":24,"failed":9},[107],{"cveId":66,"name":78,"severity":23,"cvss":69,"added":79,"epss":70,"published":108,"ranges":109,"checked":4,"hits":110,"covers":24},"2019-07-17T13:15:10.687",[],[]]