[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fA6z3G26MpUkP6Nk0UrWEL5jGFFtUawHbolQsuRhF77M":3,"g5a-family:netapp\u002Foncommand_system_manager":153,"g5a-ex:netapp\u002Foncommand_system_manager@*":154},{"success":4,"data":5},true,{"product":6,"versions":48,"topVulnerabilitiesByEpss":64,"kevVulnerabilities":121,"seoMetadata":132,"meta":151},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":47},"netapp","oncommand_system_manager",15,27,2,"2021-02-08",[14,18,20,22,25,27,29,31,33,35,37,39,41,43,45],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"2.0.2",0,false,{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},"2.1",{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},"2.2",{"version":23,"cve_count":24,"kev_count":16,"has_kev":17},"3.0",1,{"version":26,"cve_count":16,"kev_count":16,"has_kev":17},"3.0.0",{"version":28,"cve_count":16,"kev_count":16,"has_kev":17},"3.1",{"version":30,"cve_count":16,"kev_count":16,"has_kev":17},"3.1.1",{"version":32,"cve_count":16,"kev_count":16,"has_kev":17},"3.1.2",{"version":34,"cve_count":24,"kev_count":16,"has_kev":17},"3.1.3",{"version":36,"cve_count":24,"kev_count":16,"has_kev":17},"3.x",{"version":38,"cve_count":11,"kev_count":16,"has_kev":17},"8.3",{"version":40,"cve_count":11,"kev_count":16,"has_kev":17},"8.3.1",{"version":42,"cve_count":11,"kev_count":16,"has_kev":17},"8.3.2",{"version":44,"cve_count":11,"kev_count":16,"has_kev":17},"9.3",{"version":46,"cve_count":11,"kev_count":16,"has_kev":17},"9.4","Oncommand System Manager by Netapp is a technology product with 15 tracked versions and 27 known security vulnerabilities including 2 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[49,50,51,52,53,54,55,56,57,58,59,60,61,62,63],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},{"version":23,"cve_count":24,"kev_count":16,"has_kev":17},{"version":26,"cve_count":16,"kev_count":16,"has_kev":17},{"version":28,"cve_count":16,"kev_count":16,"has_kev":17},{"version":30,"cve_count":16,"kev_count":16,"has_kev":17},{"version":32,"cve_count":16,"kev_count":16,"has_kev":17},{"version":34,"cve_count":24,"kev_count":16,"has_kev":17},{"version":36,"cve_count":24,"kev_count":16,"has_kev":17},{"version":38,"cve_count":11,"kev_count":16,"has_kev":17},{"version":40,"cve_count":11,"kev_count":16,"has_kev":17},{"version":42,"cve_count":11,"kev_count":16,"has_kev":17},{"version":44,"cve_count":11,"kev_count":16,"has_kev":17},{"version":46,"cve_count":11,"kev_count":16,"has_kev":17},[65,73,80,85,92,97,102,106,111,116],{"cveId":66,"description":67,"publishedDate":68,"cvssScore":69,"cvssVersion":70,"severity":71,"isKev":4,"epssScore":72},"CVE-2020-1938","When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.","2020-02-24",9.8,"v3.1","Critical",0.9927,{"cveId":74,"description":75,"publishedDate":76,"cvssScore":77,"cvssVersion":70,"severity":78,"isKev":17,"epssScore":79},"CVE-2020-11022","In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","2020-04-29",6.1,"Medium",0.99215,{"cveId":81,"description":82,"publishedDate":83,"cvssScore":77,"cvssVersion":70,"severity":78,"isKev":17,"epssScore":84},"CVE-2019-11358","jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.","2019-04-20",0.8682,{"cveId":86,"description":87,"publishedDate":88,"cvssScore":89,"cvssVersion":70,"severity":90,"isKev":17,"epssScore":91},"CVE-2020-13935","The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.","2020-07-14",7.5,"High",0.86608,{"cveId":93,"description":94,"publishedDate":76,"cvssScore":95,"cvssVersion":70,"severity":78,"isKev":4,"epssScore":96},"CVE-2020-11023","In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003Coption> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",6.9,0.84887,{"cveId":98,"description":99,"publishedDate":100,"cvssScore":69,"cvssVersion":70,"severity":71,"isKev":17,"epssScore":101},"CVE-2019-17571","Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.","2019-12-20",0.6998,{"cveId":103,"description":104,"publishedDate":88,"cvssScore":89,"cvssVersion":70,"severity":90,"isKev":17,"epssScore":105},"CVE-2020-13934","An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP\u002F1.1 processor after the upgrade to HTTP\u002F2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.",0.64124,{"cveId":107,"description":108,"publishedDate":109,"cvssScore":89,"cvssVersion":70,"severity":90,"isKev":17,"epssScore":110},"CVE-2020-11996","A specially crafted sequence of HTTP\u002F2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP\u002F2 connections, the server could become unresponsive.","2020-06-26",0.26699,{"cveId":112,"description":113,"publishedDate":114,"cvssScore":89,"cvssVersion":70,"severity":90,"isKev":17,"epssScore":115},"CVE-2020-17527","While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP\u002F2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP\u002F2 connection, it is possible that information could leak between requests.","2020-12-03",0.24622,{"cveId":117,"description":118,"publishedDate":119,"cvssScore":69,"cvssVersion":70,"severity":71,"isKev":17,"epssScore":120},"CVE-2017-7658","In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP\u002F1.x configurations), and 9.4.x (all HTTP\u002F1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.","2018-06-26",0.19362,[122,127],{"cveId":93,"description":94,"publishedDate":76,"cvssScore":95,"severity":78,"isKev":4,"epssScore":96,"cisaVulnName":123,"cisaDateAdded":124,"cisaShortDescription":125,"cisaRequiredAction":126},"JQuery Cross-Site Scripting (XSS) Vulnerability","2025-01-23","JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":66,"description":67,"publishedDate":68,"cvssScore":69,"severity":71,"isKev":4,"epssScore":72,"cisaVulnName":128,"cisaDateAdded":129,"cisaShortDescription":130,"cisaRequiredAction":131},"Apache Tomcat Improper Privilege Management Vulnerability","2022-03-03","Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.","Apply updates per vendor instructions.",{"title":133,"metaDescription":134,"keywords":135,"structuredData":136},"Oncommand System Manager by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Oncommand System Manager by Netapp covering 15 versions with 27 tracked vulnerabilities including 1 critical and 0 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Oncommand System Manager vulnerabilities, Oncommand System Manager security, Oncommand System Manager CVE, Netapp Oncommand System Manager, Oncommand System Manager threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Oncommand System Manager KEV, Oncommand System Manager exploited vulnerabilities",{"@context":137,"@type":138,"name":139,"description":134,"url":140,"manufacturer":141,"applicationCategory":145,"softwareVersion":146,"mainEntity":147},"https:\u002F\u002Fschema.org","SoftwareApplication","Oncommand System Manager","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Foncommand_system_manager",{"@type":142,"name":143,"url":144},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","15 versions tracked",{"@type":148,"name":149,"description":150,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Oncommand System Manager Security Vulnerabilities","Security vulnerabilities affecting Oncommand System Manager by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":152,"apiVersion":23},"2026-10-17T17:04:26.947Z",[],{"rows":155,"total":11,"capped":17,"failed":16},[156,161],{"cveId":93,"name":123,"severity":78,"cvss":95,"added":124,"epss":96,"published":157,"ranges":158,"checked":4,"hits":160,"covers":17},"2020-04-29T21:15:11.743",[159],"3.0 to 3.1.3",[],{"cveId":66,"name":128,"severity":71,"cvss":69,"added":129,"epss":72,"published":162,"ranges":163,"checked":4,"hits":165,"covers":17},"2020-02-24T22:15:12.057",[164],"3.0.0 to 3.1.3",[]]