[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fagG3zA6JZ9xfNGxjD1JfVddoR2uymdI5EpnyLix9V3E":3,"g5a-family:netapp\u002Fhci_compute_node":119,"g5a-ex:netapp\u002Fhci_compute_node@*":126},{"success":4,"data":5},true,{"product":6,"versions":15,"topVulnerabilitiesByEpss":16,"kevVulnerabilities":78,"seoMetadata":97,"meta":116},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":14},"netapp","hci_compute_node",0,134,2,"2025-03-13",[],"Hci Compute Node by Netapp is a technology product and 134 known security vulnerabilities including 2 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[],[17,25,33,39,45,50,57,62,67,73],{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":4,"epssScore":24},"CVE-2025-24813","Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and\u002For Information disclosure and\u002For malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and\u002For inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to       perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","2025-03-10",9.8,"v3.1","Critical",0.99927,{"cveId":26,"description":27,"publishedDate":28,"cvssScore":29,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":32},"CVE-2024-6387","A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","2024-07-01",8.1,"High",false,0.99506,{"cveId":34,"description":35,"publishedDate":36,"cvssScore":37,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":38},"CVE-2022-2068","In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).","2022-06-21",7.3,0.96391,{"cveId":40,"description":41,"publishedDate":42,"cvssScore":43,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":44},"CVE-2022-34169","The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.","2022-07-19",7.5,0.81759,{"cveId":46,"description":47,"publishedDate":48,"cvssScore":43,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":49},"CVE-2022-21449","Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N).","2022-04-19",0.77151,{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":22,"severity":55,"isKev":31,"epssScore":56},"CVE-2017-5715","Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.","2018-01-04",5.6,"Medium",0.74041,{"cveId":58,"description":59,"publishedDate":60,"cvssScore":43,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":61},"CVE-2024-6119","Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic certificate chain validation (signatures, dates, ...) is not\naffected, the denial of service can occur only when the application also\nspecifies an expected DNS name, Email address or IP address.\n\nTLS servers rarely solicit client certificates, and even when they do, they\ngenerally don't perform a name check against a reference identifier (expected\nidentity), but rather extract the presented identity after checking the\ncertificate chain.  So TLS servers are generally not affected and the severity\nof the issue is Moderate.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.","2024-09-03",0.66582,{"cveId":63,"description":64,"publishedDate":65,"cvssScore":29,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":66},"CVE-2021-22901","curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP\u002F1.1 connection or multiplexed HTTP\u002F2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.","2021-06-11",0.63531,{"cveId":68,"description":69,"publishedDate":70,"cvssScore":71,"cvssVersion":22,"severity":30,"isKev":4,"epssScore":72},"CVE-2019-13272","In the Linux kernel before 5.1.17, ptrace_link in kernel\u002Fptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.","2019-07-17",7.8,0.52199,{"cveId":74,"description":75,"publishedDate":76,"cvssScore":43,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":77},"CVE-2018-25032","zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.","2022-03-25",0.51733,[79,88,92],{"cveId":80,"description":81,"publishedDate":82,"cvssScore":71,"severity":30,"isKev":4,"epssScore":83,"cisaVulnName":84,"cisaDateAdded":85,"cisaShortDescription":86,"cisaRequiredAction":87},"CVE-2022-0492","A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel\u002Fcgroup\u002Fcgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.","2022-03-03",0.05528,"Linux Kernel Improper Authentication Vulnerability","2026-06-02","Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"severity":23,"isKev":4,"epssScore":24,"cisaVulnName":89,"cisaDateAdded":90,"cisaShortDescription":91,"cisaRequiredAction":87},"Apache Tomcat Path Equivalence Vulnerability","2025-04-01","Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.",{"cveId":68,"description":69,"publishedDate":70,"cvssScore":71,"severity":30,"isKev":4,"epssScore":72,"cisaVulnName":93,"cisaDateAdded":94,"cisaShortDescription":95,"cisaRequiredAction":96},"Linux Kernel Improper Privilege Management Vulnerability","2021-12-10","Kernel\u002Fptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.","Apply updates per vendor instructions.",{"title":98,"metaDescription":99,"keywords":100,"structuredData":101},"Hci Compute Node by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Hci Compute Node by Netapp with 134 tracked vulnerabilities including 1 critical and 2 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Hci Compute Node vulnerabilities, Hci Compute Node security, Hci Compute Node CVE, Netapp Hci Compute Node, Hci Compute Node threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Hci Compute Node KEV, Hci Compute Node exploited vulnerabilities",{"@context":102,"@type":103,"name":104,"description":99,"url":105,"manufacturer":106,"applicationCategory":110,"softwareVersion":111,"mainEntity":112},"https:\u002F\u002Fschema.org","SoftwareApplication","Hci Compute Node","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Fhci_compute_node",{"@type":107,"name":108,"url":109},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","Multiple versions",{"@type":113,"name":114,"description":115,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Hci Compute Node Security Vulnerabilities","Security vulnerabilities affecting Hci Compute Node by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":117,"apiVersion":118},"2026-10-17T15:26:25.731Z","3.0",[120,123],{"product":121,"cves":122},"hci_compute_node_firmware",34,{"product":124,"cves":125},"hci_compute_node_bios",20,{"rows":127,"total":140,"capped":31,"failed":9},[128,132,136],{"cveId":80,"name":84,"severity":30,"cvss":71,"added":85,"epss":83,"published":129,"ranges":130,"checked":4,"hits":131,"covers":31},"2022-03-03T19:15:08.633",[],[],{"cveId":18,"name":89,"severity":23,"cvss":21,"added":90,"epss":24,"published":133,"ranges":134,"checked":4,"hits":135,"covers":31},"2025-03-10T17:15:35.067",[],[],{"cveId":68,"name":93,"severity":30,"cvss":71,"added":94,"epss":72,"published":137,"ranges":138,"checked":4,"hits":139,"covers":31},"2019-07-17T13:15:10.687",[],[],3]