[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fydY9qcsF1b4SoCeg-pKDlTVANxsN6BUwHrwVWp9TVgg":3,"g5a-family:netapp\u002Fontap_9":88,"g5a-ex:netapp\u002Fontap_9@*":89},{"success":4,"data":5},true,{"product":6,"versions":15,"topVulnerabilitiesByEpss":16,"kevVulnerabilities":60,"seoMetadata":66,"meta":85},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":14},"netapp","ontap_9",0,7,1,"2024-12-18",[],"Ontap 9 by Netapp is a technology product and 7 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[],[17,25,33,39,46,51,55],{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":4,"epssScore":24},"CVE-2024-38475","Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally\u002Fdirectly reachable by any URL, resulting in code execution or source code disclosure. \n\nSubstitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag \"UnsafePrefixStat\" can be used to opt back in once ensuring the substitution is appropriately constrained.","2024-07-01",9.1,"v3.1","Critical",0.99957,{"cveId":26,"description":27,"publishedDate":28,"cvssScore":29,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":32},"CVE-2024-6119","Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic certificate chain validation (signatures, dates, ...) is not\naffected, the denial of service can occur only when the application also\nspecifies an expected DNS name, Email address or IP address.\n\nTLS servers rarely solicit client certificates, and even when they do, they\ngenerally don't perform a name check against a reference identifier (expected\nidentity), but rather extract the presented identity after checking the\ncertificate chain.  So TLS servers are generally not affected and the severity\nof the issue is Moderate.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.","2024-09-03",7.5,"High",false,0.66582,{"cveId":34,"description":35,"publishedDate":36,"cvssScore":37,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":38},"CVE-2022-42915","curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error\u002Fcleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0.","2022-10-29",8.1,0.02926,{"cveId":40,"description":41,"publishedDate":42,"cvssScore":43,"cvssVersion":22,"severity":44,"isKev":31,"epssScore":45},"CVE-2023-27535","An authentication bypass vulnerability exists in libcurl \u003C8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.","2023-03-30",5.9,"Medium",0.01803,{"cveId":47,"description":48,"publishedDate":49,"cvssScore":29,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":50},"CVE-2024-26461","Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in \u002Fkrb5\u002Fsrc\u002Flib\u002Fgssapi\u002Fkrb5\u002Fk5sealv3.c.","2024-02-29",0.01128,{"cveId":52,"description":53,"publishedDate":12,"cvssScore":29,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":54},"CVE-2024-53580","iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function.",0.0092,{"cveId":56,"description":57,"publishedDate":49,"cvssScore":58,"cvssVersion":22,"severity":44,"isKev":31,"epssScore":59},"CVE-2024-26458","Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in \u002Fkrb5\u002Fsrc\u002Flib\u002Frpc\u002Fpmap_rmt.c.",5.3,0.00815,[61],{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"severity":23,"isKev":4,"epssScore":24,"cisaVulnName":62,"cisaDateAdded":63,"cisaShortDescription":64,"cisaRequiredAction":65},"Apache HTTP Server Improper Escaping of Output Vulnerability","2025-05-01","Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally\u002Fdirectly reachable by any URL, resulting in code execution or source code disclosure.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"title":67,"metaDescription":68,"keywords":69,"structuredData":70},"Ontap 9 by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Ontap 9 by Netapp with 7 tracked vulnerabilities including 1 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Ontap 9 vulnerabilities, Ontap 9 security, Ontap 9 CVE, Netapp Ontap 9, Ontap 9 threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Ontap 9 KEV, Ontap 9 exploited vulnerabilities",{"@context":71,"@type":72,"name":73,"description":68,"url":74,"manufacturer":75,"applicationCategory":79,"softwareVersion":80,"mainEntity":81},"https:\u002F\u002Fschema.org","SoftwareApplication","Ontap 9","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Fontap_9",{"@type":76,"name":77,"url":78},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","Multiple versions",{"@type":82,"name":83,"description":84,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Ontap 9 Security Vulnerabilities","Security vulnerabilities affecting Ontap 9 by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":86,"apiVersion":87},"2026-10-18T13:17:50.738Z","3.0",[],{"rows":90,"total":11,"capped":31,"failed":9},[91],{"cveId":18,"name":62,"severity":23,"cvss":21,"added":63,"epss":24,"published":92,"ranges":93,"checked":4,"hits":94,"covers":31},"2024-07-01T19:15:04.883",[],[]]