[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyhd19VKOutg1YF-M9booaOPX4G4sYKQYBjDoayJpztI":3,"g5a-family:netapp\u002Fontap_tools":122,"g5a-ex:netapp\u002Fontap_tools@*":123},{"success":4,"data":5},true,{"product":6,"versions":23,"topVulnerabilitiesByEpss":26,"kevVulnerabilities":90,"seoMetadata":100,"meta":119},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":9,"lastCveUpdate":11,"versions":12,"description":22},"netapp","ontap_tools",2,22,"2024-11-11",[13,18],{"version":14,"cve_count":15,"kev_count":16,"has_kev":17},"10",12,0,false,{"version":19,"cve_count":20,"kev_count":21,"has_kev":4},"9",7,1,"Ontap Tools by Netapp is a technology product with 2 tracked versions and 22 known security vulnerabilities including 2 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[24,25],{"version":14,"cve_count":15,"kev_count":16,"has_kev":17},{"version":19,"cve_count":20,"kev_count":21,"has_kev":4},[27,35,42,48,54,59,64,70,76,83],{"cveId":28,"description":29,"publishedDate":30,"cvssScore":31,"cvssVersion":32,"severity":33,"isKev":4,"epssScore":34},"CVE-2021-44228","Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","2021-12-10",10,"v3.1","Critical",0.99999,{"cveId":36,"description":37,"publishedDate":38,"cvssScore":39,"cvssVersion":32,"severity":40,"isKev":4,"epssScore":41},"CVE-2021-3156","Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via \"sudoedit -s\" and a command-line argument that ends with a single backslash character.","2021-01-26",7.8,"High",0.99962,{"cveId":43,"description":44,"publishedDate":45,"cvssScore":46,"cvssVersion":32,"severity":40,"isKev":17,"epssScore":47},"CVE-2024-6387","A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","2024-07-01",8.1,0.99506,{"cveId":49,"description":50,"publishedDate":51,"cvssScore":52,"cvssVersion":32,"severity":40,"isKev":17,"epssScore":53},"CVE-2024-6119","Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic certificate chain validation (signatures, dates, ...) is not\naffected, the denial of service can occur only when the application also\nspecifies an expected DNS name, Email address or IP address.\n\nTLS servers rarely solicit client certificates, and even when they do, they\ngenerally don't perform a name check against a reference identifier (expected\nidentity), but rather extract the presented identity after checking the\ncertificate chain.  So TLS servers are generally not affected and the severity\nof the issue is Moderate.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.","2024-09-03",7.5,0.66582,{"cveId":55,"description":56,"publishedDate":57,"cvssScore":52,"cvssVersion":32,"severity":40,"isKev":17,"epssScore":58},"CVE-2021-28165","In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.","2021-04-01",0.53861,{"cveId":60,"description":61,"publishedDate":62,"cvssScore":52,"cvssVersion":32,"severity":40,"isKev":17,"epssScore":63},"CVE-2024-34750","Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP\u002F2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP\u002F2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.","2024-07-03",0.04602,{"cveId":65,"description":66,"publishedDate":67,"cvssScore":68,"cvssVersion":32,"severity":40,"isKev":17,"epssScore":69},"CVE-2023-38709","Faulty input validation in the core of Apache allows malicious or exploitable backend\u002Fcontent generators to split HTTP responses.\n\nThis issue affects Apache HTTP Server: through 2.4.58.","2024-04-04",7.3,0.03914,{"cveId":71,"description":72,"publishedDate":73,"cvssScore":74,"cvssVersion":32,"severity":40,"isKev":17,"epssScore":75},"CVE-2020-13817","ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.","2020-06-04",7.4,0.03252,{"cveId":77,"description":78,"publishedDate":79,"cvssScore":80,"cvssVersion":32,"severity":81,"isKev":17,"epssScore":82},"CVE-2023-36054","lib\u002Fkadm5\u002Fkadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.","2023-08-07",6.5,"Medium",0.02814,{"cveId":84,"description":85,"publishedDate":86,"cvssScore":87,"cvssVersion":88,"severity":40,"isKev":17,"epssScore":89},"CVE-2024-7254","Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups \u002F series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.","2024-09-19",8.7,"v4.0",0.02772,[91,96],{"cveId":36,"description":37,"publishedDate":38,"cvssScore":39,"severity":40,"isKev":4,"epssScore":41,"cisaVulnName":92,"cisaDateAdded":93,"cisaShortDescription":94,"cisaRequiredAction":95},"Sudo Heap-Based Buffer Overflow Vulnerability","2022-04-06","Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.","Apply updates per vendor instructions.",{"cveId":28,"description":29,"publishedDate":30,"cvssScore":31,"severity":33,"isKev":4,"epssScore":34,"cisaVulnName":97,"cisaDateAdded":30,"cisaShortDescription":98,"cisaRequiredAction":99},"Apache Log4j2 Remote Code Execution Vulnerability","Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.","For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https:\u002F\u002Fwww.cisa.gov\u002Fuscert\u002Fed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.",{"title":101,"metaDescription":102,"keywords":103,"structuredData":104},"Ontap Tools by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Ontap Tools by Netapp covering 2 versions with 22 tracked vulnerabilities including 1 critical and 1 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Ontap Tools vulnerabilities, Ontap Tools security, Ontap Tools CVE, Netapp Ontap Tools, Ontap Tools threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Ontap Tools KEV, Ontap Tools exploited vulnerabilities",{"@context":105,"@type":106,"name":107,"description":102,"url":108,"manufacturer":109,"applicationCategory":113,"softwareVersion":114,"mainEntity":115},"https:\u002F\u002Fschema.org","SoftwareApplication","Ontap Tools","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Fontap_tools",{"@type":110,"name":111,"url":112},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","2 versions tracked",{"@type":116,"name":117,"description":118,"vulnerabilityCount":10,"dateModified":11},"SecurityVulnerability","Ontap Tools Security Vulnerabilities","Security vulnerabilities affecting Ontap Tools by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":9,"lastUpdated":11,"generatedAt":120,"apiVersion":121},"2026-10-18T00:22:54.999Z","3.0",[],{"rows":124,"total":9,"capped":17,"failed":16},[125,129],{"cveId":36,"name":92,"severity":40,"cvss":39,"added":93,"epss":41,"published":126,"ranges":127,"checked":4,"hits":128,"covers":17},"2021-01-26T21:15:12.987",[19],[],{"cveId":28,"name":97,"severity":33,"cvss":31,"added":30,"epss":34,"published":130,"ranges":131,"checked":4,"hits":132,"covers":17},"2021-12-10T10:15:09.143",[],[]]