[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHsu1uX7S2cc8iTOEUsxU9tP-oiO2GxNMAZ4742vZxj4":3,"g5a-family:netapp\u002Foncommand_balance":129,"g5a-ex:netapp\u002Foncommand_balance@*":130},{"success":4,"data":5},true,{"product":6,"versions":19,"topVulnerabilitiesByEpss":21,"kevVulnerabilities":79,"seoMetadata":107,"meta":126},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":18},"netapp","oncommand_balance",1,83,7,"2019-01-16",[14],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"4.2",0,false,"Oncommand Balance by Netapp is a technology product with 1 tracked version and 83 known security vulnerabilities including 7 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[20],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},[22,30,37,42,47,52,57,63,68,74],{"cveId":23,"description":24,"publishedDate":25,"cvssScore":26,"cvssVersion":27,"severity":28,"isKev":4,"epssScore":29},"CVE-2017-5638","The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.","2017-03-11",9.8,"v3.1","Critical",0.99999,{"cveId":31,"description":32,"publishedDate":33,"cvssScore":34,"cvssVersion":27,"severity":35,"isKev":4,"epssScore":36},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",8.1,"High",0.99968,{"cveId":38,"description":39,"publishedDate":40,"cvssScore":34,"cvssVersion":27,"severity":35,"isKev":4,"epssScore":41},"CVE-2017-12615","When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-09-19",0.99641,{"cveId":43,"description":44,"publishedDate":45,"cvssScore":34,"cvssVersion":27,"severity":35,"isKev":4,"epssScore":46},"CVE-2017-9805","The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.","2017-09-15",0.99396,{"cveId":48,"description":49,"publishedDate":50,"cvssScore":26,"cvssVersion":27,"severity":28,"isKev":4,"epssScore":51},"CVE-2016-3427","Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.","2016-04-21",0.92334,{"cveId":53,"description":54,"publishedDate":55,"cvssScore":11,"cvssVersion":27,"severity":35,"isKev":4,"epssScore":56},"CVE-2016-5195","Race condition in mm\u002Fgup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka \"Dirty COW.\"","2016-11-10",0.83524,{"cveId":58,"description":59,"publishedDate":60,"cvssScore":61,"cvssVersion":27,"severity":35,"isKev":4,"epssScore":62},"CVE-2010-1871","JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL.  NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.","2010-08-05",8.8,0.83397,{"cveId":64,"description":65,"publishedDate":66,"cvssScore":26,"cvssVersion":27,"severity":28,"isKev":17,"epssScore":67},"CVE-2015-7871","Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.","2017-08-07",0.81762,{"cveId":69,"description":70,"publishedDate":71,"cvssScore":72,"cvssVersion":27,"severity":35,"isKev":17,"epssScore":73},"CVE-2016-8610","A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS\u002FSSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS\u002FSSL server consume an excessive amount of CPU and fail to accept connections from other clients.","2017-11-13",7.5,0.39657,{"cveId":75,"description":76,"publishedDate":77,"cvssScore":26,"cvssVersion":27,"severity":28,"isKev":17,"epssScore":78},"CVE-2017-7525","A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.","2018-02-06",0.37721,[80,85,89,92,96,100,104],{"cveId":48,"description":49,"publishedDate":50,"cvssScore":26,"severity":28,"isKev":4,"epssScore":51,"cisaVulnName":81,"cisaDateAdded":82,"cisaShortDescription":83,"cisaRequiredAction":84},"Oracle Java SE and JRockit Unspecified Vulnerability","2023-05-12","Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.","Apply updates per vendor instructions.",{"cveId":38,"description":39,"publishedDate":40,"cvssScore":34,"severity":35,"isKev":4,"epssScore":41,"cisaVulnName":86,"cisaDateAdded":87,"cisaShortDescription":88,"cisaRequiredAction":84},"Apache Tomcat on Windows Remote Code Execution Vulnerability","2022-03-25","When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",{"cveId":31,"description":32,"publishedDate":33,"cvssScore":34,"severity":35,"isKev":4,"epssScore":36,"cisaVulnName":90,"cisaDateAdded":87,"cisaShortDescription":91,"cisaRequiredAction":84},"Apache Tomcat Remote Code Execution Vulnerability","When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",{"cveId":53,"description":54,"publishedDate":55,"cvssScore":11,"severity":35,"isKev":4,"epssScore":56,"cisaVulnName":93,"cisaDateAdded":94,"cisaShortDescription":95,"cisaRequiredAction":84},"Linux Kernel Race Condition Vulnerability","2022-03-03","Race condition in mm\u002Fgup.c in the Linux kernel allows local users to escalate privileges.",{"cveId":58,"description":59,"publishedDate":60,"cvssScore":61,"severity":35,"isKev":4,"epssScore":62,"cisaVulnName":97,"cisaDateAdded":98,"cisaShortDescription":99,"cisaRequiredAction":84},"Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability","2021-12-10","JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.",{"cveId":43,"description":44,"publishedDate":45,"cvssScore":34,"severity":35,"isKev":4,"epssScore":46,"cisaVulnName":101,"cisaDateAdded":102,"cisaShortDescription":103,"cisaRequiredAction":84},"Apache Struts Deserialization of Untrusted Data Vulnerability","2021-11-03","Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.",{"cveId":23,"description":24,"publishedDate":25,"cvssScore":26,"severity":28,"isKev":4,"epssScore":29,"cisaVulnName":105,"cisaDateAdded":102,"cisaShortDescription":106,"cisaRequiredAction":84},"Apache Struts Remote Code Execution Vulnerability","Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.",{"title":108,"metaDescription":109,"keywords":110,"structuredData":111},"Oncommand Balance by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Oncommand Balance by Netapp covering 1 version with 83 tracked vulnerabilities including 2 critical and 5 high-severity issues and 7 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Oncommand Balance vulnerabilities, Oncommand Balance security, Oncommand Balance CVE, Netapp Oncommand Balance, Oncommand Balance threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Oncommand Balance KEV, Oncommand Balance exploited vulnerabilities",{"@context":112,"@type":113,"name":114,"description":109,"url":115,"manufacturer":116,"applicationCategory":120,"softwareVersion":121,"mainEntity":122},"https:\u002F\u002Fschema.org","SoftwareApplication","Oncommand Balance","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Foncommand_balance",{"@type":117,"name":118,"url":119},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","1 versions tracked",{"@type":123,"name":124,"description":125,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Oncommand Balance Security Vulnerabilities","Security vulnerabilities affecting Oncommand Balance by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":127,"apiVersion":128},"2026-10-17T12:52:09.137Z","3.0",[],{"rows":131,"total":11,"capped":17,"failed":154},[132,135,138,141,144,147,151],{"cveId":48,"name":81,"severity":28,"cvss":26,"added":82,"epss":51,"published":50,"ranges":133,"hits":134,"checked":17,"covers":17},[],[],{"cveId":38,"name":86,"severity":35,"cvss":34,"added":87,"epss":41,"published":40,"ranges":136,"hits":137,"checked":17,"covers":17},[],[],{"cveId":31,"name":90,"severity":35,"cvss":34,"added":87,"epss":36,"published":33,"ranges":139,"hits":140,"checked":17,"covers":17},[],[],{"cveId":53,"name":93,"severity":35,"cvss":11,"added":94,"epss":56,"published":55,"ranges":142,"hits":143,"checked":17,"covers":17},[],[],{"cveId":58,"name":97,"severity":35,"cvss":61,"added":98,"epss":62,"published":60,"ranges":145,"hits":146,"checked":17,"covers":17},[],[],{"cveId":43,"name":101,"severity":35,"cvss":34,"added":102,"epss":46,"published":148,"ranges":149,"checked":4,"hits":150,"covers":17},"2017-09-15T19:29:00.237",[],[],{"cveId":23,"name":105,"severity":28,"cvss":26,"added":102,"epss":29,"published":25,"ranges":152,"hits":153,"checked":17,"covers":17},[],[],6]