[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqvMsr_Q2jnv4nj36-GEX4S7SlKVuFfDnbBdyX9USoGM":3,"g5a-family:netapp\u002Foncommand_insight":240,"g5a-ex:netapp\u002Foncommand_insight@*":241},{"success":4,"data":5},true,{"product":6,"versions":78,"topVulnerabilitiesByEpss":109,"kevVulnerabilities":169,"seoMetadata":218,"meta":237},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":77},"netapp","oncommand_insight",30,959,9,"2025-02-10",[14,18,20,22,24,26,28,30,32,34,36,38,40,42,44,46,48,50,52,55,57,59,61,63,65,67,69,71,73,75],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"7.0",0,false,{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},"7.0.1",{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},"7.0.2",{"version":23,"cve_count":16,"kev_count":16,"has_kev":17},"7.0.3",{"version":25,"cve_count":16,"kev_count":16,"has_kev":17},"7.0.4",{"version":27,"cve_count":16,"kev_count":16,"has_kev":17},"7.1",{"version":29,"cve_count":16,"kev_count":16,"has_kev":17},"7.1.1",{"version":31,"cve_count":16,"kev_count":16,"has_kev":17},"7.1.2",{"version":33,"cve_count":16,"kev_count":16,"has_kev":17},"7.1.3",{"version":35,"cve_count":16,"kev_count":16,"has_kev":17},"7.1.4",{"version":37,"cve_count":16,"kev_count":16,"has_kev":17},"7.2",{"version":39,"cve_count":16,"kev_count":16,"has_kev":17},"7.2.1",{"version":41,"cve_count":16,"kev_count":16,"has_kev":17},"7.2.2",{"version":43,"cve_count":16,"kev_count":16,"has_kev":17},"7.2.3",{"version":45,"cve_count":16,"kev_count":16,"has_kev":17},"7.2.4",{"version":47,"cve_count":16,"kev_count":16,"has_kev":17},"7.2.5",{"version":49,"cve_count":16,"kev_count":16,"has_kev":17},"7.2.6",{"version":51,"cve_count":16,"kev_count":16,"has_kev":17},"7.3",{"version":53,"cve_count":54,"kev_count":16,"has_kev":17},"7.3.0",1,{"version":56,"cve_count":16,"kev_count":16,"has_kev":17},"7.3.1",{"version":58,"cve_count":16,"kev_count":16,"has_kev":17},"7.3.10",{"version":60,"cve_count":16,"kev_count":16,"has_kev":17},"7.3.11",{"version":62,"cve_count":16,"kev_count":16,"has_kev":17},"7.3.2",{"version":64,"cve_count":16,"kev_count":16,"has_kev":17},"7.3.3",{"version":66,"cve_count":16,"kev_count":16,"has_kev":17},"7.3.4",{"version":68,"cve_count":16,"kev_count":16,"has_kev":17},"7.3.5",{"version":70,"cve_count":16,"kev_count":16,"has_kev":17},"7.3.6",{"version":72,"cve_count":16,"kev_count":16,"has_kev":17},"7.3.7",{"version":74,"cve_count":16,"kev_count":16,"has_kev":17},"7.3.8",{"version":76,"cve_count":16,"kev_count":16,"has_kev":17},"7.3.9","Oncommand Insight by Netapp is a technology product with 30 tracked versions and 959 known security vulnerabilities including 9 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},{"version":23,"cve_count":16,"kev_count":16,"has_kev":17},{"version":25,"cve_count":16,"kev_count":16,"has_kev":17},{"version":27,"cve_count":16,"kev_count":16,"has_kev":17},{"version":29,"cve_count":16,"kev_count":16,"has_kev":17},{"version":31,"cve_count":16,"kev_count":16,"has_kev":17},{"version":33,"cve_count":16,"kev_count":16,"has_kev":17},{"version":35,"cve_count":16,"kev_count":16,"has_kev":17},{"version":37,"cve_count":16,"kev_count":16,"has_kev":17},{"version":39,"cve_count":16,"kev_count":16,"has_kev":17},{"version":41,"cve_count":16,"kev_count":16,"has_kev":17},{"version":43,"cve_count":16,"kev_count":16,"has_kev":17},{"version":45,"cve_count":16,"kev_count":16,"has_kev":17},{"version":47,"cve_count":16,"kev_count":16,"has_kev":17},{"version":49,"cve_count":16,"kev_count":16,"has_kev":17},{"version":51,"cve_count":16,"kev_count":16,"has_kev":17},{"version":53,"cve_count":54,"kev_count":16,"has_kev":17},{"version":56,"cve_count":16,"kev_count":16,"has_kev":17},{"version":58,"cve_count":16,"kev_count":16,"has_kev":17},{"version":60,"cve_count":16,"kev_count":16,"has_kev":17},{"version":62,"cve_count":16,"kev_count":16,"has_kev":17},{"version":64,"cve_count":16,"kev_count":16,"has_kev":17},{"version":66,"cve_count":16,"kev_count":16,"has_kev":17},{"version":68,"cve_count":16,"kev_count":16,"has_kev":17},{"version":70,"cve_count":16,"kev_count":16,"has_kev":17},{"version":72,"cve_count":16,"kev_count":16,"has_kev":17},{"version":74,"cve_count":16,"kev_count":16,"has_kev":17},{"version":76,"cve_count":16,"kev_count":16,"has_kev":17},[110,118,124,130,135,142,148,153,158,164],{"cveId":111,"description":112,"publishedDate":113,"cvssScore":114,"cvssVersion":115,"severity":116,"isKev":4,"epssScore":117},"CVE-2023-44487","The HTTP\u002F2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","2023-10-10",7.5,"v3.1","High",0.99999,{"cveId":119,"description":120,"publishedDate":121,"cvssScore":122,"cvssVersion":115,"severity":123,"isKev":4,"epssScore":117},"CVE-2021-44228","Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","2021-12-10",10,"Critical",{"cveId":125,"description":126,"publishedDate":127,"cvssScore":128,"cvssVersion":115,"severity":116,"isKev":4,"epssScore":129},"CVE-2018-11776","Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.","2018-08-22",8.1,0.99991,{"cveId":131,"description":132,"publishedDate":133,"cvssScore":128,"cvssVersion":115,"severity":116,"isKev":4,"epssScore":134},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",0.99968,{"cveId":136,"description":137,"publishedDate":138,"cvssScore":139,"cvssVersion":115,"severity":140,"isKev":17,"epssScore":141},"CVE-2020-11022","In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","2020-04-29",6.1,"Medium",0.99215,{"cveId":143,"description":144,"publishedDate":145,"cvssScore":146,"cvssVersion":115,"severity":123,"isKev":4,"epssScore":147},"CVE-2016-3427","Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.","2016-04-21",9.8,0.92334,{"cveId":149,"description":150,"publishedDate":151,"cvssScore":146,"cvssVersion":115,"severity":123,"isKev":4,"epssScore":152},"CVE-2016-8735","Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.","2017-04-06",0.90338,{"cveId":154,"description":155,"publishedDate":156,"cvssScore":146,"cvssVersion":115,"severity":123,"isKev":17,"epssScore":157},"CVE-2017-5645","In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.","2017-04-17",0.89792,{"cveId":159,"description":160,"publishedDate":161,"cvssScore":162,"cvssVersion":115,"severity":140,"isKev":17,"epssScore":163},"CVE-2021-35590","Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1\u002FAV:A\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H).","2021-10-20",6.3,0.88497,{"cveId":165,"description":166,"publishedDate":167,"cvssScore":146,"cvssVersion":115,"severity":123,"isKev":17,"epssScore":168},"CVE-2021-3711","In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the \"out\" parameter can be NULL and, on exit, the \"outlen\" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the \"out\" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).","2021-08-24",0.87816,[170,179,183,192,197,200,203,210,214],{"cveId":171,"description":172,"publishedDate":138,"cvssScore":173,"severity":140,"isKev":4,"epssScore":174,"cisaVulnName":175,"cisaDateAdded":176,"cisaShortDescription":177,"cisaRequiredAction":178},"CVE-2020-11023","In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003Coption> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",6.9,0.84887,"JQuery Cross-Site Scripting (XSS) Vulnerability","2025-01-23","JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":111,"description":112,"publishedDate":113,"cvssScore":114,"severity":116,"isKev":4,"epssScore":117,"cisaVulnName":180,"cisaDateAdded":113,"cisaShortDescription":181,"cisaRequiredAction":182},"HTTP\u002F2 Rapid Reset Attack Vulnerability","HTTP\u002F2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":184,"description":185,"publishedDate":186,"cvssScore":187,"severity":116,"isKev":4,"epssScore":188,"cisaVulnName":189,"cisaDateAdded":190,"cisaShortDescription":191,"cisaRequiredAction":178},"CVE-2023-41993","The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.","2023-09-21",8.8,0.24349,"Apple Multiple Products WebKit Code Execution Vulnerability","2023-09-25","Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.",{"cveId":143,"description":144,"publishedDate":145,"cvssScore":146,"severity":123,"isKev":4,"epssScore":147,"cisaVulnName":193,"cisaDateAdded":194,"cisaShortDescription":195,"cisaRequiredAction":196},"Oracle Java SE and JRockit Unspecified Vulnerability","2023-05-12","Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.","Apply updates per vendor instructions.",{"cveId":149,"description":150,"publishedDate":151,"cvssScore":146,"severity":123,"isKev":4,"epssScore":152,"cisaVulnName":198,"cisaDateAdded":194,"cisaShortDescription":199,"cisaRequiredAction":196},"Apache Tomcat Remote Code Execution Vulnerability","Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.",{"cveId":131,"description":132,"publishedDate":133,"cvssScore":128,"severity":116,"isKev":4,"epssScore":134,"cisaVulnName":198,"cisaDateAdded":201,"cisaShortDescription":202,"cisaRequiredAction":196},"2022-03-25","When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",{"cveId":204,"description":205,"publishedDate":206,"cvssScore":187,"severity":116,"isKev":4,"epssScore":207,"cisaVulnName":208,"cisaDateAdded":121,"cisaShortDescription":209,"cisaRequiredAction":196},"CVE-2010-1871","JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL.  NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.","2010-08-05",0.83397,"Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability","JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.",{"cveId":119,"description":120,"publishedDate":121,"cvssScore":122,"severity":123,"isKev":4,"epssScore":117,"cisaVulnName":211,"cisaDateAdded":121,"cisaShortDescription":212,"cisaRequiredAction":213},"Apache Log4j2 Remote Code Execution Vulnerability","Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.","For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https:\u002F\u002Fwww.cisa.gov\u002Fuscert\u002Fed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.",{"cveId":125,"description":126,"publishedDate":127,"cvssScore":128,"severity":116,"isKev":4,"epssScore":129,"cisaVulnName":215,"cisaDateAdded":216,"cisaShortDescription":217,"cisaRequiredAction":196},"Apache Struts Remote Code Execution Vulnerability","2021-11-03","Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace.  Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.",{"title":219,"metaDescription":220,"keywords":221,"structuredData":222},"Oncommand Insight by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Oncommand Insight by Netapp covering 30 versions with 959 tracked vulnerabilities including 3 critical and 5 high-severity issues and 9 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Oncommand Insight vulnerabilities, Oncommand Insight security, Oncommand Insight CVE, Netapp Oncommand Insight, Oncommand Insight threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Oncommand Insight KEV, Oncommand Insight exploited vulnerabilities",{"@context":223,"@type":224,"name":225,"description":220,"url":226,"manufacturer":227,"applicationCategory":231,"softwareVersion":232,"mainEntity":233},"https:\u002F\u002Fschema.org","SoftwareApplication","Oncommand Insight","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Foncommand_insight",{"@type":228,"name":229,"url":230},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","30 versions tracked",{"@type":234,"name":235,"description":236,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Oncommand Insight Security Vulnerabilities","Security vulnerabilities affecting Oncommand Insight by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":238,"apiVersion":239},"2026-10-16T23:52:19.842Z","3.0",[],{"rows":242,"total":11,"capped":17,"failed":16},[243,247,251,255,259,263,267,271,275],{"cveId":171,"name":175,"severity":140,"cvss":173,"added":176,"epss":174,"published":244,"ranges":245,"checked":4,"hits":246,"covers":17},"2020-04-29T21:15:11.743",[],[],{"cveId":111,"name":180,"severity":116,"cvss":114,"added":113,"epss":117,"published":248,"ranges":249,"checked":4,"hits":250,"covers":17},"2023-10-10T14:15:10.883",[],[],{"cveId":184,"name":189,"severity":116,"cvss":187,"added":190,"epss":188,"published":252,"ranges":253,"checked":4,"hits":254,"covers":17},"2023-09-21T19:15:11.66",[],[],{"cveId":143,"name":193,"severity":123,"cvss":146,"added":194,"epss":147,"published":256,"ranges":257,"checked":4,"hits":258,"covers":17},"2016-04-21T11:00:21.667",[],[],{"cveId":149,"name":198,"severity":123,"cvss":146,"added":194,"epss":152,"published":260,"ranges":261,"checked":4,"hits":262,"covers":17},"2017-04-06T21:59:00.243",[],[],{"cveId":131,"name":198,"severity":116,"cvss":128,"added":201,"epss":134,"published":264,"ranges":265,"checked":4,"hits":266,"covers":17},"2017-10-04T01:29:02.12",[],[],{"cveId":204,"name":208,"severity":116,"cvss":187,"added":121,"epss":207,"published":268,"ranges":269,"checked":4,"hits":270,"covers":17},"2010-08-05T13:23:09.477",[],[],{"cveId":119,"name":211,"severity":123,"cvss":122,"added":121,"epss":117,"published":272,"ranges":273,"checked":4,"hits":274,"covers":17},"2021-12-10T10:15:09.143",[],[],{"cveId":125,"name":215,"severity":116,"cvss":128,"added":216,"epss":129,"published":276,"ranges":277,"checked":4,"hits":278,"covers":17},"2018-08-22T13:29:00.753",[],[]]