[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZI551Xkc6Diy3y-GMjd10ld0YN4SsElaUOgYGn9F4mg":3,"g5a-ex:netapp\u002Felement_software@*":102,"g5a-family:netapp\u002Felement_software":104},{"success":4,"data":5},true,{"product":6,"versions":14,"topVulnerabilitiesByEpss":15,"kevVulnerabilities":79,"seoMetadata":80,"meta":99},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":9,"lastCveUpdate":11,"versions":12,"description":13},"netapp","element_software",0,98,"2022-11-09",[],"Element Software by Netapp is a technology product and 98 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[],[16,25,32,37,44,50,56,62,69,75],{"cveId":17,"description":18,"publishedDate":19,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":24},"CVE-2022-2068","In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).","2022-06-21",7.3,"v3.1","High",false,0.96391,{"cveId":26,"description":27,"publishedDate":28,"cvssScore":29,"cvssVersion":21,"severity":30,"isKev":23,"epssScore":31},"CVE-2022-32206","curl \u003C 7.84.0 supports \"chained\" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable \"links\" in this \"decompression chain\" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a \"malloc bomb\", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.","2022-07-07",6.5,"Medium",0.36348,{"cveId":33,"description":34,"publishedDate":28,"cvssScore":35,"cvssVersion":21,"severity":30,"isKev":23,"epssScore":36},"CVE-2022-32205","A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl \u003C 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a \"sister server\" to effectively cause a denial of service for a sibling site on the same second level domain using this method.",4.3,0.31497,{"cveId":38,"description":39,"publishedDate":40,"cvssScore":41,"cvssVersion":42,"severity":22,"isKev":23,"epssScore":43},"CVE-2018-7182","The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10.","2018-03-06",7.5,"v3.0",0.28834,{"cveId":45,"description":46,"publishedDate":47,"cvssScore":48,"cvssVersion":21,"severity":30,"isKev":23,"epssScore":49},"CVE-2019-6110","In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.","2019-01-31",6.8,0.24901,{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":21,"severity":30,"isKev":23,"epssScore":55},"CVE-2019-1559","If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).","2019-02-27",5.9,0.17139,{"cveId":57,"description":58,"publishedDate":59,"cvssScore":60,"cvssVersion":21,"severity":30,"isKev":23,"epssScore":61},"CVE-2017-10355","Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L).","2017-10-19",5.3,0.16181,{"cveId":63,"description":64,"publishedDate":65,"cvssScore":66,"cvssVersion":21,"severity":67,"isKev":23,"epssScore":68},"CVE-2017-7657","In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.","2018-06-26",9.8,"Critical",0.14879,{"cveId":70,"description":71,"publishedDate":72,"cvssScore":73,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":74},"CVE-2019-3462","Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.","2019-01-28",8.1,0.14555,{"cveId":76,"description":77,"publishedDate":28,"cvssScore":66,"cvssVersion":21,"severity":67,"isKev":23,"epssScore":78},"CVE-2022-32207","When curl \u003C 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.",0.12321,[],{"title":81,"metaDescription":82,"keywords":83,"structuredData":84},"Element Software by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Element Software by Netapp with 98 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Element Software vulnerabilities, Element Software security, Element Software CVE, Netapp Element Software, Element Software threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":85,"@type":86,"name":87,"description":82,"url":88,"manufacturer":89,"applicationCategory":93,"softwareVersion":94,"mainEntity":95},"https:\u002F\u002Fschema.org","SoftwareApplication","Element Software","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Felement_software",{"@type":90,"name":91,"url":92},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","Multiple versions",{"@type":96,"name":97,"description":98,"vulnerabilityCount":10,"dateModified":11},"SecurityVulnerability","Element Software Security Vulnerabilities","Security vulnerabilities affecting Element Software by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":9,"lastUpdated":11,"generatedAt":100,"apiVersion":101},"2026-10-17T12:52:07.483Z","3.0",{"rows":103,"total":9,"capped":23,"failed":9},[],[105,108],{"product":106,"cves":107},"element_software_management_node",9,{"product":109,"cves":110},"element_software_management",5]