[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCKgOKef25h6i93kC1xtSgUDXg_IWl0f7GbORkCES8Yo":3,"g5a-ex:netapp\u002Foncommand_shift@*":115,"g5a-family:netapp\u002Foncommand_shift":133},{"success":4,"data":5},true,{"product":6,"versions":19,"topVulnerabilitiesByEpss":21,"kevVulnerabilities":78,"seoMetadata":93,"meta":112},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":18},"netapp","oncommand_shift",1,63,4,"2018-02-06",[14],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"1.2",0,false,"Oncommand Shift by Netapp is a technology product with 1 tracked version and 63 known security vulnerabilities including 4 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[20],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},[22,30,35,42,47,52,56,63,69,74],{"cveId":23,"description":24,"publishedDate":25,"cvssScore":26,"cvssVersion":27,"severity":28,"isKev":4,"epssScore":29},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",8.1,"v3.1","High",0.99968,{"cveId":31,"description":32,"publishedDate":33,"cvssScore":26,"cvssVersion":27,"severity":28,"isKev":4,"epssScore":34},"CVE-2017-12615","When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-09-19",0.99641,{"cveId":36,"description":37,"publishedDate":38,"cvssScore":39,"cvssVersion":27,"severity":40,"isKev":4,"epssScore":41},"CVE-2016-3427","Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.","2016-04-21",9.8,"Critical",0.92334,{"cveId":43,"description":44,"publishedDate":45,"cvssScore":39,"cvssVersion":27,"severity":40,"isKev":4,"epssScore":46},"CVE-2016-8735","Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.","2017-04-06",0.90338,{"cveId":48,"description":49,"publishedDate":50,"cvssScore":39,"cvssVersion":27,"severity":40,"isKev":17,"epssScore":51},"CVE-2017-17485","FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.","2018-01-10",0.49727,{"cveId":53,"description":54,"publishedDate":12,"cvssScore":39,"cvssVersion":27,"severity":40,"isKev":17,"epssScore":55},"CVE-2017-7525","A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.",0.37721,{"cveId":57,"description":58,"publishedDate":59,"cvssScore":60,"cvssVersion":27,"severity":61,"isKev":17,"epssScore":62},"CVE-2017-10355","Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L).","2017-10-19",5.3,"Medium",0.16181,{"cveId":64,"description":65,"publishedDate":66,"cvssScore":67,"cvssVersion":27,"severity":40,"isKev":17,"epssScore":68},"CVE-2016-5018","In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.","2017-08-10",9.1,0.10303,{"cveId":70,"description":71,"publishedDate":59,"cvssScore":72,"cvssVersion":27,"severity":28,"isKev":17,"epssScore":73},"CVE-2017-10309","Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 8u144 and 9. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:L).",7.1,0.08794,{"cveId":75,"description":76,"publishedDate":12,"cvssScore":39,"cvssVersion":27,"severity":40,"isKev":17,"epssScore":77},"CVE-2017-15095","A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.",0.08357,[79,84,87,91],{"cveId":36,"description":37,"publishedDate":38,"cvssScore":39,"severity":40,"isKev":4,"epssScore":41,"cisaVulnName":80,"cisaDateAdded":81,"cisaShortDescription":82,"cisaRequiredAction":83},"Oracle Java SE and JRockit Unspecified Vulnerability","2023-05-12","Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.","Apply updates per vendor instructions.",{"cveId":43,"description":44,"publishedDate":45,"cvssScore":39,"severity":40,"isKev":4,"epssScore":46,"cisaVulnName":85,"cisaDateAdded":81,"cisaShortDescription":86,"cisaRequiredAction":83},"Apache Tomcat Remote Code Execution Vulnerability","Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.",{"cveId":31,"description":32,"publishedDate":33,"cvssScore":26,"severity":28,"isKev":4,"epssScore":34,"cisaVulnName":88,"cisaDateAdded":89,"cisaShortDescription":90,"cisaRequiredAction":83},"Apache Tomcat on Windows Remote Code Execution Vulnerability","2022-03-25","When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",{"cveId":23,"description":24,"publishedDate":25,"cvssScore":26,"severity":28,"isKev":4,"epssScore":29,"cisaVulnName":85,"cisaDateAdded":89,"cisaShortDescription":92,"cisaRequiredAction":83},"When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",{"title":94,"metaDescription":95,"keywords":96,"structuredData":97},"Oncommand Shift by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Oncommand Shift by Netapp covering 1 version with 63 tracked vulnerabilities including 2 critical and 2 high-severity issues and 4 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Oncommand Shift vulnerabilities, Oncommand Shift security, Oncommand Shift CVE, Netapp Oncommand Shift, Oncommand Shift threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Oncommand Shift KEV, Oncommand Shift exploited vulnerabilities",{"@context":98,"@type":99,"name":100,"description":95,"url":101,"manufacturer":102,"applicationCategory":106,"softwareVersion":107,"mainEntity":108},"https:\u002F\u002Fschema.org","SoftwareApplication","Oncommand Shift","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Foncommand_shift",{"@type":103,"name":104,"url":105},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","1 versions tracked",{"@type":109,"name":110,"description":111,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Oncommand Shift Security Vulnerabilities","Security vulnerabilities affecting Oncommand Shift by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":113,"apiVersion":114},"2026-10-17T12:56:04.030Z","3.0",{"rows":116,"total":11,"capped":17,"failed":16},[117,121,125,129],{"cveId":36,"name":80,"severity":40,"cvss":39,"added":81,"epss":41,"published":118,"ranges":119,"checked":4,"hits":120,"covers":17},"2016-04-21T11:00:21.667",[],[],{"cveId":43,"name":85,"severity":40,"cvss":39,"added":81,"epss":46,"published":122,"ranges":123,"checked":4,"hits":124,"covers":17},"2017-04-06T21:59:00.243",[],[],{"cveId":31,"name":88,"severity":28,"cvss":26,"added":89,"epss":34,"published":126,"ranges":127,"checked":4,"hits":128,"covers":17},"2017-09-19T13:29:00.19",[],[],{"cveId":23,"name":85,"severity":28,"cvss":26,"added":89,"epss":29,"published":130,"ranges":131,"checked":4,"hits":132,"covers":17},"2017-10-04T01:29:02.12",[],[],[]]