[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgvz_V6hbEjNHlxsadwhKo_6ZT-106ZRGXJpe3cAVIzU":3,"g5a-family:netapp\u002Foncommand_workflow_automation":156,"g5a-ex:netapp\u002Foncommand_workflow_automation@*":157},{"success":4,"data":5},true,{"product":6,"versions":38,"topVulnerabilitiesByEpss":49,"kevVulnerabilities":111,"seoMetadata":135,"meta":154},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":37},"netapp","oncommand_workflow_automation",10,734,4,"2025-02-04",[14,18,21,23,25,27,29,31,33,35],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"2.2.1",0,false,{"version":19,"cve_count":20,"kev_count":16,"has_kev":17},"3.0",1,{"version":22,"cve_count":16,"kev_count":16,"has_kev":17},"3.1",{"version":24,"cve_count":16,"kev_count":16,"has_kev":17},"4.0",{"version":26,"cve_count":16,"kev_count":16,"has_kev":17},"4.1",{"version":28,"cve_count":16,"kev_count":16,"has_kev":17},"4.2",{"version":30,"cve_count":20,"kev_count":16,"has_kev":17},"5.0",{"version":32,"cve_count":16,"kev_count":16,"has_kev":17},"5.0.1",{"version":34,"cve_count":16,"kev_count":16,"has_kev":17},"5.1",{"version":36,"cve_count":16,"kev_count":16,"has_kev":17},"5.1.1","Oncommand Workflow Automation by Netapp is a technology product with 10 tracked versions and 734 known security vulnerabilities including 4 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[39,40,41,42,43,44,45,46,47,48],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},{"version":19,"cve_count":20,"kev_count":16,"has_kev":17},{"version":22,"cve_count":16,"kev_count":16,"has_kev":17},{"version":24,"cve_count":16,"kev_count":16,"has_kev":17},{"version":26,"cve_count":16,"kev_count":16,"has_kev":17},{"version":28,"cve_count":16,"kev_count":16,"has_kev":17},{"version":30,"cve_count":20,"kev_count":16,"has_kev":17},{"version":32,"cve_count":16,"kev_count":16,"has_kev":17},{"version":34,"cve_count":16,"kev_count":16,"has_kev":17},{"version":36,"cve_count":16,"kev_count":16,"has_kev":17},[50,58,63,70,77,82,87,93,100,105],{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":55,"severity":56,"isKev":4,"epssScore":57},"CVE-2018-11776","Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.","2018-08-22",8.1,"v3.1","High",0.99991,{"cveId":59,"description":60,"publishedDate":61,"cvssScore":54,"cvssVersion":55,"severity":56,"isKev":4,"epssScore":62},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",0.99968,{"cveId":64,"description":65,"publishedDate":66,"cvssScore":67,"cvssVersion":55,"severity":68,"isKev":4,"epssScore":69},"CVE-2016-3427","Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.","2016-04-21",9.8,"Critical",0.92334,{"cveId":71,"description":72,"publishedDate":73,"cvssScore":74,"cvssVersion":75,"severity":68,"isKev":17,"epssScore":76},"CVE-2018-10933","A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.","2018-10-17",9.1,"v3.0",0.91789,{"cveId":78,"description":79,"publishedDate":80,"cvssScore":67,"cvssVersion":55,"severity":68,"isKev":17,"epssScore":81},"CVE-2017-5645","In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.","2017-04-17",0.89792,{"cveId":83,"description":84,"publishedDate":85,"cvssScore":67,"cvssVersion":55,"severity":68,"isKev":17,"epssScore":86},"CVE-2021-3711","In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the \"out\" parameter can be NULL and, on exit, the \"outlen\" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the \"out\" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).","2021-08-24",0.87816,{"cveId":88,"description":89,"publishedDate":90,"cvssScore":91,"cvssVersion":55,"severity":56,"isKev":17,"epssScore":92},"CVE-2022-1292","The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).","2022-05-03",7.3,0.82612,{"cveId":94,"description":95,"publishedDate":96,"cvssScore":97,"cvssVersion":55,"severity":98,"isKev":17,"epssScore":99},"CVE-2022-21279","Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1\u002FAV:A\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H).","2022-01-19",6.3,"Medium",0.78951,{"cveId":101,"description":102,"publishedDate":103,"cvssScore":67,"cvssVersion":55,"severity":68,"isKev":17,"epssScore":104},"CVE-2023-38545","This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.","2023-10-18",0.78689,{"cveId":106,"description":107,"publishedDate":108,"cvssScore":109,"cvssVersion":55,"severity":56,"isKev":17,"epssScore":110},"CVE-2022-21449","Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N).","2022-04-19",7.5,0.77151,[112,122,127,131],{"cveId":113,"description":114,"publishedDate":115,"cvssScore":116,"severity":56,"isKev":4,"epssScore":117,"cisaVulnName":118,"cisaDateAdded":119,"cisaShortDescription":120,"cisaRequiredAction":121},"CVE-2023-41993","The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.","2023-09-21",8.8,0.24349,"Apple Multiple Products WebKit Code Execution Vulnerability","2023-09-25","Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":64,"description":65,"publishedDate":66,"cvssScore":67,"severity":68,"isKev":4,"epssScore":69,"cisaVulnName":123,"cisaDateAdded":124,"cisaShortDescription":125,"cisaRequiredAction":126},"Oracle Java SE and JRockit Unspecified Vulnerability","2023-05-12","Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.","Apply updates per vendor instructions.",{"cveId":59,"description":60,"publishedDate":61,"cvssScore":54,"severity":56,"isKev":4,"epssScore":62,"cisaVulnName":128,"cisaDateAdded":129,"cisaShortDescription":130,"cisaRequiredAction":126},"Apache Tomcat Remote Code Execution Vulnerability","2022-03-25","When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"severity":56,"isKev":4,"epssScore":57,"cisaVulnName":132,"cisaDateAdded":133,"cisaShortDescription":134,"cisaRequiredAction":126},"Apache Struts Remote Code Execution Vulnerability","2021-11-03","Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace.  Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.",{"title":136,"metaDescription":137,"keywords":138,"structuredData":139},"Oncommand Workflow Automation by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Oncommand Workflow Automation by Netapp covering 10 versions with 734 tracked vulnerabilities including 1 critical and 3 high-severity issues and 4 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Oncommand Workflow Automation vulnerabilities, Oncommand Workflow Automation security, Oncommand Workflow Automation CVE, Netapp Oncommand Workflow Automation, Oncommand Workflow Automation threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Oncommand Workflow Automation KEV, Oncommand Workflow Automation exploited vulnerabilities",{"@context":140,"@type":141,"name":142,"description":137,"url":143,"manufacturer":144,"applicationCategory":148,"softwareVersion":149,"mainEntity":150},"https:\u002F\u002Fschema.org","SoftwareApplication","Oncommand Workflow Automation","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Foncommand_workflow_automation",{"@type":145,"name":146,"url":147},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","10 versions tracked",{"@type":151,"name":152,"description":153,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Oncommand Workflow Automation Security Vulnerabilities","Security vulnerabilities affecting Oncommand Workflow Automation by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":155,"apiVersion":19},"2026-10-17T10:34:18.531Z",[],{"rows":158,"total":11,"capped":17,"failed":16},[159,163,167,171],{"cveId":113,"name":118,"severity":56,"cvss":116,"added":119,"epss":117,"published":160,"ranges":161,"checked":4,"hits":162,"covers":17},"2023-09-21T19:15:11.66",[],[],{"cveId":64,"name":123,"severity":68,"cvss":67,"added":124,"epss":69,"published":164,"ranges":165,"checked":4,"hits":166,"covers":17},"2016-04-21T11:00:21.667",[],[],{"cveId":59,"name":128,"severity":56,"cvss":54,"added":129,"epss":62,"published":168,"ranges":169,"checked":4,"hits":170,"covers":17},"2017-10-04T01:29:02.12",[],[],{"cveId":51,"name":132,"severity":56,"cvss":54,"added":133,"epss":57,"published":172,"ranges":173,"checked":4,"hits":174,"covers":17},"2018-08-22T13:29:00.753",[],[]]