[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$funOteEdkxFxPLiQuraaWdOnhqTAcqfK0d1NopLww4PU":3,"g5a-family:netapp\u002Fsnapcenter":189,"g5a-ex:netapp\u002Fsnapcenter@*":196},{"success":4,"data":5},true,{"product":6,"versions":66,"topVulnerabilitiesByEpss":91,"kevVulnerabilities":154,"seoMetadata":168,"meta":187},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":65},"netapp","snapcenter",24,566,3,"2024-07-09",[14,18,20,22,24,26,28,30,32,34,36,38,40,42,44,46,48,51,53,55,57,59,61,63],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"1.0",0,false,{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},"1.0.1",{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},"1.1",{"version":23,"cve_count":16,"kev_count":16,"has_kev":17},"2.0",{"version":25,"cve_count":16,"kev_count":16,"has_kev":17},"3.0",{"version":27,"cve_count":16,"kev_count":16,"has_kev":17},"3.0.1",{"version":29,"cve_count":16,"kev_count":16,"has_kev":17},"4.0",{"version":31,"cve_count":16,"kev_count":16,"has_kev":17},"4.1",{"version":33,"cve_count":16,"kev_count":16,"has_kev":17},"4.1.1",{"version":35,"cve_count":16,"kev_count":16,"has_kev":17},"4.2",{"version":37,"cve_count":16,"kev_count":16,"has_kev":17},"4.2.1",{"version":39,"cve_count":16,"kev_count":16,"has_kev":17},"4.3",{"version":41,"cve_count":16,"kev_count":16,"has_kev":17},"4.3.1",{"version":43,"cve_count":16,"kev_count":16,"has_kev":17},"4.3.2",{"version":45,"cve_count":16,"kev_count":16,"has_kev":17},"4.4",{"version":47,"cve_count":16,"kev_count":16,"has_kev":17},"4.5",{"version":49,"cve_count":50,"kev_count":16,"has_kev":17},"4.7",1,{"version":52,"cve_count":50,"kev_count":16,"has_kev":17},"4.8",{"version":54,"cve_count":16,"kev_count":16,"has_kev":17},"4.9",{"version":56,"cve_count":50,"kev_count":16,"has_kev":17},"5.0",{"version":58,"cve_count":16,"kev_count":16,"has_kev":17},"6.0",{"version":60,"cve_count":16,"kev_count":16,"has_kev":17},"6.0.1",{"version":62,"cve_count":16,"kev_count":16,"has_kev":17},"6.1",{"version":64,"cve_count":16,"kev_count":16,"has_kev":17},"6.2","Snapcenter by Netapp is a technology product with 24 tracked versions and 566 known security vulnerabilities including 3 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},{"version":23,"cve_count":16,"kev_count":16,"has_kev":17},{"version":25,"cve_count":16,"kev_count":16,"has_kev":17},{"version":27,"cve_count":16,"kev_count":16,"has_kev":17},{"version":29,"cve_count":16,"kev_count":16,"has_kev":17},{"version":31,"cve_count":16,"kev_count":16,"has_kev":17},{"version":33,"cve_count":16,"kev_count":16,"has_kev":17},{"version":35,"cve_count":16,"kev_count":16,"has_kev":17},{"version":37,"cve_count":16,"kev_count":16,"has_kev":17},{"version":39,"cve_count":16,"kev_count":16,"has_kev":17},{"version":41,"cve_count":16,"kev_count":16,"has_kev":17},{"version":43,"cve_count":16,"kev_count":16,"has_kev":17},{"version":45,"cve_count":16,"kev_count":16,"has_kev":17},{"version":47,"cve_count":16,"kev_count":16,"has_kev":17},{"version":49,"cve_count":50,"kev_count":16,"has_kev":17},{"version":52,"cve_count":50,"kev_count":16,"has_kev":17},{"version":54,"cve_count":16,"kev_count":16,"has_kev":17},{"version":56,"cve_count":50,"kev_count":16,"has_kev":17},{"version":58,"cve_count":16,"kev_count":16,"has_kev":17},{"version":60,"cve_count":16,"kev_count":16,"has_kev":17},{"version":62,"cve_count":16,"kev_count":16,"has_kev":17},{"version":64,"cve_count":16,"kev_count":16,"has_kev":17},[92,100,107,112,119,126,132,138,144,149],{"cveId":93,"description":94,"publishedDate":95,"cvssScore":96,"cvssVersion":97,"severity":98,"isKev":4,"epssScore":99},"CVE-2021-44228","Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","2021-12-10",10,"v3.1","Critical",0.99999,{"cveId":101,"description":102,"publishedDate":103,"cvssScore":104,"cvssVersion":97,"severity":105,"isKev":4,"epssScore":106},"CVE-2018-11776","Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.","2018-08-22",8.1,"High",0.99991,{"cveId":108,"description":109,"publishedDate":110,"cvssScore":104,"cvssVersion":97,"severity":105,"isKev":4,"epssScore":111},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",0.99968,{"cveId":113,"description":114,"publishedDate":115,"cvssScore":116,"cvssVersion":97,"severity":117,"isKev":17,"epssScore":118},"CVE-2020-11022","In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","2020-04-29",6.1,"Medium",0.99215,{"cveId":120,"description":121,"publishedDate":122,"cvssScore":123,"cvssVersion":124,"severity":98,"isKev":17,"epssScore":125},"CVE-2018-10933","A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.","2018-10-17",9.1,"v3.0",0.91789,{"cveId":127,"description":128,"publishedDate":129,"cvssScore":130,"cvssVersion":97,"severity":98,"isKev":17,"epssScore":131},"CVE-2017-5645","In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.","2017-04-17",9.8,0.89792,{"cveId":133,"description":134,"publishedDate":135,"cvssScore":136,"cvssVersion":97,"severity":105,"isKev":17,"epssScore":137},"CVE-2020-5398","In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a \"Content-Disposition\" header in the response where the filename attribute is derived from user supplied input.","2020-01-17",7.5,0.88768,{"cveId":139,"description":140,"publishedDate":141,"cvssScore":142,"cvssVersion":97,"severity":117,"isKev":17,"epssScore":143},"CVE-2021-35590","Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1\u002FAV:A\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H).","2021-10-20",6.3,0.88497,{"cveId":145,"description":146,"publishedDate":147,"cvssScore":130,"cvssVersion":97,"severity":98,"isKev":17,"epssScore":148},"CVE-2021-3711","In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the \"out\" parameter can be NULL and, on exit, the \"outlen\" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the \"out\" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).","2021-08-24",0.87816,{"cveId":150,"description":151,"publishedDate":152,"cvssScore":116,"cvssVersion":97,"severity":117,"isKev":17,"epssScore":153},"CVE-2019-11358","jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.","2019-04-20",0.8682,[155,160,164],{"cveId":108,"description":109,"publishedDate":110,"cvssScore":104,"severity":105,"isKev":4,"epssScore":111,"cisaVulnName":156,"cisaDateAdded":157,"cisaShortDescription":158,"cisaRequiredAction":159},"Apache Tomcat Remote Code Execution Vulnerability","2022-03-25","When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","Apply updates per vendor instructions.",{"cveId":93,"description":94,"publishedDate":95,"cvssScore":96,"severity":98,"isKev":4,"epssScore":99,"cisaVulnName":161,"cisaDateAdded":95,"cisaShortDescription":162,"cisaRequiredAction":163},"Apache Log4j2 Remote Code Execution Vulnerability","Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.","For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https:\u002F\u002Fwww.cisa.gov\u002Fuscert\u002Fed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.",{"cveId":101,"description":102,"publishedDate":103,"cvssScore":104,"severity":105,"isKev":4,"epssScore":106,"cisaVulnName":165,"cisaDateAdded":166,"cisaShortDescription":167,"cisaRequiredAction":159},"Apache Struts Remote Code Execution Vulnerability","2021-11-03","Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace.  Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.",{"title":169,"metaDescription":170,"keywords":171,"structuredData":172},"Snapcenter by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Snapcenter by Netapp covering 24 versions with 566 tracked vulnerabilities including 1 critical and 2 high-severity issues and 3 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Snapcenter vulnerabilities, Snapcenter security, Snapcenter CVE, Netapp Snapcenter, Snapcenter threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Snapcenter KEV, Snapcenter exploited vulnerabilities",{"@context":173,"@type":174,"name":175,"description":170,"url":176,"manufacturer":177,"applicationCategory":181,"softwareVersion":182,"mainEntity":183},"https:\u002F\u002Fschema.org","SoftwareApplication","Snapcenter","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Fsnapcenter",{"@type":178,"name":179,"url":180},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","24 versions tracked",{"@type":184,"name":185,"description":186,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Snapcenter Security Vulnerabilities","Security vulnerabilities affecting Snapcenter by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":188,"apiVersion":25},"2026-10-17T10:34:18.489Z",[190,193],{"product":191,"cves":192},"snapcenter_server",23,{"product":194,"cves":195},"snapcenter_plug-in",5,{"rows":197,"total":11,"capped":17,"failed":16},[198,202,206],{"cveId":108,"name":156,"severity":105,"cvss":104,"added":157,"epss":111,"published":199,"ranges":200,"checked":4,"hits":201,"covers":17},"2017-10-04T01:29:02.12",[],[],{"cveId":93,"name":161,"severity":98,"cvss":96,"added":95,"epss":99,"published":203,"ranges":204,"checked":4,"hits":205,"covers":17},"2021-12-10T10:15:09.143",[],[],{"cveId":101,"name":165,"severity":105,"cvss":104,"added":166,"epss":106,"published":207,"ranges":208,"checked":4,"hits":209,"covers":17},"2018-08-22T13:29:00.753",[],[]]