[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fD6T7UsYsBeLKM-MXns0bGzbBKC51H55-twA68X1pZ6o":3,"g5a-family:netapp\u002Fsnap_creator_framework":134,"g5a-ex:netapp\u002Fsnap_creator_framework@*":135},{"success":4,"data":5},true,{"product":6,"versions":33,"topVulnerabilitiesByEpss":42,"kevVulnerabilities":101,"seoMetadata":112,"meta":131},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":32},"netapp","snap_creator_framework",8,42,2,"2022-04-14",[14,18,20,22,24,26,28,30],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"4.1.0",0,false,{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},"4.1.1",{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},"4.1.2",{"version":23,"cve_count":16,"kev_count":16,"has_kev":17},"4.3",{"version":25,"cve_count":16,"kev_count":16,"has_kev":17},"4.3.0",{"version":27,"cve_count":16,"kev_count":16,"has_kev":17},"4.3.1",{"version":29,"cve_count":16,"kev_count":16,"has_kev":17},"4.3.2",{"version":31,"cve_count":16,"kev_count":16,"has_kev":17},"4.3.3","Snap Creator Framework by Netapp is a technology product with 8 tracked versions and 42 known security vulnerabilities including 2 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[34,35,36,37,38,39,40,41],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},{"version":23,"cve_count":16,"kev_count":16,"has_kev":17},{"version":25,"cve_count":16,"kev_count":16,"has_kev":17},{"version":27,"cve_count":16,"kev_count":16,"has_kev":17},{"version":29,"cve_count":16,"kev_count":16,"has_kev":17},{"version":31,"cve_count":16,"kev_count":16,"has_kev":17},[43,51,57,64,71,76,81,87,92,97],{"cveId":44,"description":45,"publishedDate":46,"cvssScore":47,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":50},"CVE-2021-34429","For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and\u002For bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164\u002FGHSA-v7ff-8wcx-gmc5.","2021-07-15",5.3,"v3.1","Medium",0.99298,{"cveId":52,"description":53,"publishedDate":54,"cvssScore":55,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":56},"CVE-2020-11022","In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","2020-04-29",6.1,0.99215,{"cveId":58,"description":59,"publishedDate":60,"cvssScore":61,"cvssVersion":62,"severity":49,"isKev":17,"epssScore":63},"CVE-2018-11784","When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '\u002Ffoo\u002F' when the user requested '\u002Ffoo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.","2018-10-04",4.3,"v3.0",0.9768,{"cveId":65,"description":66,"publishedDate":67,"cvssScore":68,"cvssVersion":48,"severity":69,"isKev":4,"epssScore":70},"CVE-2016-8735","Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.","2017-04-06",9.8,"Critical",0.90338,{"cveId":72,"description":73,"publishedDate":54,"cvssScore":74,"cvssVersion":48,"severity":49,"isKev":4,"epssScore":75},"CVE-2020-11023","In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003Coption> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",6.9,0.84887,{"cveId":77,"description":78,"publishedDate":79,"cvssScore":47,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":80},"CVE-2021-28169","For Eclipse Jetty versions \u003C= 9.4.40, \u003C= 10.0.2, \u003C= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `\u002Fconcat?\u002F%2557EB-INF\u002Fweb.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.","2021-06-09",0.7848,{"cveId":82,"description":83,"publishedDate":84,"cvssScore":85,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":86},"CVE-2020-27223","In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.","2021-02-26",5.2,0.78031,{"cveId":88,"description":89,"publishedDate":90,"cvssScore":55,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":91},"CVE-2020-13954","By default, Apache CXF creates a \u002Fservices page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.","2020-11-12",0.40873,{"cveId":93,"description":94,"publishedDate":95,"cvssScore":68,"cvssVersion":48,"severity":69,"isKev":17,"epssScore":96},"CVE-2017-7658","In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP\u002F1.x configurations), and 9.4.x (all HTTP\u002F1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.","2018-06-26",0.19362,{"cveId":98,"description":99,"publishedDate":95,"cvssScore":68,"cvssVersion":48,"severity":69,"isKev":17,"epssScore":100},"CVE-2017-7657","In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.",0.14879,[102,107],{"cveId":72,"description":73,"publishedDate":54,"cvssScore":74,"severity":49,"isKev":4,"epssScore":75,"cisaVulnName":103,"cisaDateAdded":104,"cisaShortDescription":105,"cisaRequiredAction":106},"JQuery Cross-Site Scripting (XSS) Vulnerability","2025-01-23","JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":65,"description":66,"publishedDate":67,"cvssScore":68,"severity":69,"isKev":4,"epssScore":70,"cisaVulnName":108,"cisaDateAdded":109,"cisaShortDescription":110,"cisaRequiredAction":111},"Apache Tomcat Remote Code Execution Vulnerability","2023-05-12","Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.","Apply updates per vendor instructions.",{"title":113,"metaDescription":114,"keywords":115,"structuredData":116},"Snap Creator Framework by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Snap Creator Framework by Netapp covering 8 versions with 42 tracked vulnerabilities including 1 critical and 0 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Snap Creator Framework vulnerabilities, Snap Creator Framework security, Snap Creator Framework CVE, Netapp Snap Creator Framework, Snap Creator Framework threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Snap Creator Framework KEV, Snap Creator Framework exploited vulnerabilities",{"@context":117,"@type":118,"name":119,"description":114,"url":120,"manufacturer":121,"applicationCategory":125,"softwareVersion":126,"mainEntity":127},"https:\u002F\u002Fschema.org","SoftwareApplication","Snap Creator Framework","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Fsnap_creator_framework",{"@type":122,"name":123,"url":124},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","8 versions tracked",{"@type":128,"name":129,"description":130,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Snap Creator Framework Security Vulnerabilities","Security vulnerabilities affecting Snap Creator Framework by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":132,"apiVersion":133},"2026-10-17T18:07:26.189Z","3.0",[],{"rows":136,"total":11,"capped":17,"failed":16},[137,141],{"cveId":72,"name":103,"severity":49,"cvss":74,"added":104,"epss":75,"published":138,"ranges":139,"checked":4,"hits":140,"covers":17},"2020-04-29T21:15:11.743",[],[],{"cveId":65,"name":108,"severity":69,"cvss":68,"added":109,"epss":70,"published":142,"ranges":143,"checked":4,"hits":144,"covers":17},"2017-04-06T21:59:00.243",[],[]]