[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHFSprew38e2ID9k0kKgbtS8jqXGCUvuEtL741hg6fZE":3,"g5a-family:netapp\u002Fsnapmanager":139,"g5a-ex:netapp\u002Fsnapmanager@*":140},{"success":4,"data":5},true,{"product":6,"versions":40,"topVulnerabilitiesByEpss":52,"kevVulnerabilities":112,"seoMetadata":118,"meta":137},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":39},"netapp","snapmanager",11,180,1,"2022-11-23",[14,18,20,22,24,26,28,30,32,34,36],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"1.1.1",0,false,{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},"2.0",{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},"2.1",{"version":23,"cve_count":16,"kev_count":16,"has_kev":17},"2.2",{"version":25,"cve_count":16,"kev_count":16,"has_kev":17},"3.0",{"version":27,"cve_count":16,"kev_count":16,"has_kev":17},"3.1",{"version":29,"cve_count":16,"kev_count":16,"has_kev":17},"3.2",{"version":31,"cve_count":16,"kev_count":16,"has_kev":17},"3.3",{"version":33,"cve_count":16,"kev_count":16,"has_kev":17},"3.3.1",{"version":35,"cve_count":16,"kev_count":16,"has_kev":17},"3.4",{"version":37,"cve_count":38,"kev_count":16,"has_kev":17},"3.4.2",2,"Snapmanager by Netapp is a technology product with 11 tracked versions and 180 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[41,42,43,44,45,46,47,48,49,50,51],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},{"version":23,"cve_count":16,"kev_count":16,"has_kev":17},{"version":25,"cve_count":16,"kev_count":16,"has_kev":17},{"version":27,"cve_count":16,"kev_count":16,"has_kev":17},{"version":29,"cve_count":16,"kev_count":16,"has_kev":17},{"version":31,"cve_count":16,"kev_count":16,"has_kev":17},{"version":33,"cve_count":16,"kev_count":16,"has_kev":17},{"version":35,"cve_count":16,"kev_count":16,"has_kev":17},{"version":37,"cve_count":38,"kev_count":16,"has_kev":17},[53,61,67,73,78,85,91,98,103,107],{"cveId":54,"description":55,"publishedDate":56,"cvssScore":57,"cvssVersion":58,"severity":59,"isKev":4,"epssScore":60},"CVE-2021-39144","XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","2021-08-23",8.5,"v3.1","High",0.98124,{"cveId":62,"description":63,"publishedDate":64,"cvssScore":65,"cvssVersion":58,"severity":59,"isKev":17,"epssScore":66},"CVE-2022-2068","In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).","2022-06-21",7.3,0.96391,{"cveId":68,"description":69,"publishedDate":70,"cvssScore":71,"cvssVersion":58,"severity":59,"isKev":17,"epssScore":72},"CVE-2020-26217","XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.","2020-11-16",8,0.85001,{"cveId":74,"description":75,"publishedDate":76,"cvssScore":65,"cvssVersion":58,"severity":59,"isKev":17,"epssScore":77},"CVE-2022-1292","The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).","2022-05-03",0.82612,{"cveId":79,"description":80,"publishedDate":81,"cvssScore":82,"cvssVersion":58,"severity":83,"isKev":17,"epssScore":84},"CVE-2020-27223","In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.","2021-02-26",5.2,"Medium",0.78031,{"cveId":86,"description":87,"publishedDate":88,"cvssScore":89,"cvssVersion":58,"severity":59,"isKev":17,"epssScore":90},"CVE-2021-29505","XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.","2021-05-28",7.5,0.77232,{"cveId":92,"description":93,"publishedDate":94,"cvssScore":95,"cvssVersion":58,"severity":96,"isKev":17,"epssScore":97},"CVE-2022-23305","By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.","2022-01-18",9.8,"Critical",0.66537,{"cveId":99,"description":100,"publishedDate":94,"cvssScore":101,"cvssVersion":58,"severity":59,"isKev":17,"epssScore":102},"CVE-2022-23302","JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.",8.8,0.63556,{"cveId":104,"description":105,"publishedDate":12,"cvssScore":89,"cvssVersion":58,"severity":59,"isKev":17,"epssScore":106},"CVE-2022-40303","An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.",0.41365,{"cveId":108,"description":109,"publishedDate":110,"cvssScore":95,"cvssVersion":58,"severity":96,"isKev":17,"epssScore":111},"CVE-2017-7658","In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP\u002F1.x configurations), and 9.4.x (all HTTP\u002F1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.","2018-06-26",0.19362,[113],{"cveId":54,"description":55,"publishedDate":56,"cvssScore":57,"severity":59,"isKev":4,"epssScore":60,"cisaVulnName":114,"cisaDateAdded":115,"cisaShortDescription":116,"cisaRequiredAction":117},"XStream Remote Code Execution Vulnerability","2023-03-10","XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.","Apply updates per vendor instructions.",{"title":119,"metaDescription":120,"keywords":121,"structuredData":122},"Snapmanager by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Snapmanager by Netapp covering 11 versions with 180 tracked vulnerabilities including 0 critical and 1 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Snapmanager vulnerabilities, Snapmanager security, Snapmanager CVE, Netapp Snapmanager, Snapmanager threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Snapmanager KEV, Snapmanager exploited vulnerabilities",{"@context":123,"@type":124,"name":125,"description":120,"url":126,"manufacturer":127,"applicationCategory":131,"softwareVersion":132,"mainEntity":133},"https:\u002F\u002Fschema.org","SoftwareApplication","Snapmanager","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Fsnapmanager",{"@type":128,"name":129,"url":130},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","11 versions tracked",{"@type":134,"name":135,"description":136,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Snapmanager Security Vulnerabilities","Security vulnerabilities affecting Snapmanager by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":138,"apiVersion":25},"2026-10-17T19:26:27.354Z",[],{"rows":141,"total":11,"capped":17,"failed":16},[142],{"cveId":54,"name":114,"severity":59,"cvss":57,"added":115,"epss":60,"published":143,"ranges":144,"checked":4,"hits":145,"covers":17},"2021-08-23T18:15:12.087",[],[]]