[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbL9bwTeWzt4hbXOZHVX2jEi-CUuvUsQybw8ZJssk_jI":3,"g5a-family:netapp\u002Fsolidfire":134,"g5a-ex:netapp\u002Fsolidfire@*":157},{"success":4,"data":5},true,{"product":6,"versions":15,"topVulnerabilitiesByEpss":16,"kevVulnerabilities":81,"seoMetadata":112,"meta":131},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":14},"netapp","solidfire",0,193,5,"2023-07-18",[],"Solidfire by Netapp is a technology product and 193 known security vulnerabilities including 5 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[],[17,25,33,39,45,51,58,64,70,75],{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":4,"epssScore":24},"CVE-2021-3156","Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via \"sudoedit -s\" and a command-line argument that ends with a single backslash character.","2021-01-26",7.8,"v3.1","High",0.99962,{"cveId":26,"description":27,"publishedDate":28,"cvssScore":29,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":32},"CVE-2021-34429","For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and\u002For bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164\u002FGHSA-v7ff-8wcx-gmc5.","2021-07-15",5.3,"Medium",false,0.99298,{"cveId":34,"description":35,"publishedDate":36,"cvssScore":37,"cvssVersion":22,"severity":23,"isKev":31,"epssScore":38},"CVE-2019-5736","runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to \u002Fproc\u002Fself\u002Fexe.","2019-02-11",8.6,0.98452,{"cveId":40,"description":41,"publishedDate":42,"cvssScore":43,"cvssVersion":22,"severity":23,"isKev":31,"epssScore":44},"CVE-2022-2068","In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).","2022-06-21",7.3,0.96391,{"cveId":46,"description":47,"publishedDate":48,"cvssScore":49,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":50},"CVE-2017-5753","Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.","2018-01-04",5.6,0.93838,{"cveId":52,"description":53,"publishedDate":54,"cvssScore":55,"cvssVersion":22,"severity":56,"isKev":31,"epssScore":57},"CVE-2021-3711","In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the \"out\" parameter can be NULL and, on exit, the \"outlen\" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the \"out\" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).","2021-08-24",9.8,"Critical",0.87816,{"cveId":59,"description":60,"publishedDate":61,"cvssScore":62,"cvssVersion":22,"severity":23,"isKev":4,"epssScore":63},"CVE-2016-5195","Race condition in mm\u002Fgup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka \"Dirty COW.\"","2016-11-10",7,0.83524,{"cveId":65,"description":66,"publishedDate":67,"cvssScore":68,"cvssVersion":22,"severity":23,"isKev":31,"epssScore":69},"CVE-2022-34169","The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.","2022-07-19",7.5,0.81759,{"cveId":71,"description":72,"publishedDate":73,"cvssScore":21,"cvssVersion":22,"severity":23,"isKev":4,"epssScore":74},"CVE-2021-22555","A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net\u002Fnetfilter\u002Fx_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space","2021-07-07",0.78684,{"cveId":76,"description":77,"publishedDate":78,"cvssScore":79,"cvssVersion":22,"severity":30,"isKev":31,"epssScore":80},"CVE-2020-27223","In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.","2021-02-26",5.2,0.78031,[82,87,92,96,104],{"cveId":71,"description":72,"publishedDate":73,"cvssScore":21,"severity":23,"isKev":4,"epssScore":74,"cisaVulnName":83,"cisaDateAdded":84,"cisaShortDescription":85,"cisaRequiredAction":86},"Linux Kernel Heap Out-of-Bounds Write Vulnerability","2025-10-06","Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":18,"description":19,"publishedDate":20,"cvssScore":21,"severity":23,"isKev":4,"epssScore":24,"cisaVulnName":88,"cisaDateAdded":89,"cisaShortDescription":90,"cisaRequiredAction":91},"Sudo Heap-Based Buffer Overflow Vulnerability","2022-04-06","Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.","Apply updates per vendor instructions.",{"cveId":59,"description":60,"publishedDate":61,"cvssScore":62,"severity":23,"isKev":4,"epssScore":63,"cisaVulnName":93,"cisaDateAdded":94,"cisaShortDescription":95,"cisaRequiredAction":91},"Linux Kernel Race Condition Vulnerability","2022-03-03","Race condition in mm\u002Fgup.c in the Linux kernel allows local users to escalate privileges.",{"cveId":97,"description":98,"publishedDate":99,"cvssScore":21,"severity":23,"isKev":4,"epssScore":100,"cisaVulnName":101,"cisaDateAdded":102,"cisaShortDescription":103,"cisaRequiredAction":91},"CVE-2019-13272","In the Linux kernel before 5.1.17, ptrace_link in kernel\u002Fptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.","2019-07-17",0.52199,"Linux Kernel Improper Privilege Management Vulnerability","2021-12-10","Kernel\u002Fptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.",{"cveId":105,"description":106,"publishedDate":107,"cvssScore":21,"severity":23,"isKev":4,"epssScore":108,"cisaVulnName":109,"cisaDateAdded":110,"cisaShortDescription":111,"cisaRequiredAction":91},"CVE-2019-2215","A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095","2019-10-11",0.72105,"Android Kernel Use-After-Free Vulnerability","2021-11-03","Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain \"AbstractEmu.\"",{"title":113,"metaDescription":114,"keywords":115,"structuredData":116},"Solidfire by Netapp - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Solidfire by Netapp with 193 tracked vulnerabilities including 0 critical and 5 high-severity issues and 5 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Solidfire vulnerabilities, Solidfire security, Solidfire CVE, Netapp Solidfire, Solidfire threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Solidfire KEV, Solidfire exploited vulnerabilities",{"@context":117,"@type":118,"name":119,"description":114,"url":120,"manufacturer":121,"applicationCategory":125,"softwareVersion":126,"mainEntity":127},"https:\u002F\u002Fschema.org","SoftwareApplication","Solidfire","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Fsolidfire",{"@type":122,"name":123,"url":124},"Organization","Netapp","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetapp","Security Software","Multiple versions",{"@type":128,"name":129,"description":130,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Solidfire Security Vulnerabilities","Security vulnerabilities affecting Solidfire by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":132,"apiVersion":133},"2026-10-17T15:44:15.070Z","3.0",[135,138,141,144,147,150,153,155],{"product":136,"cves":137},"solidfire_\\&_hci_management_node",96,{"product":139,"cves":140},"solidfire_baseboard_management_controller",86,{"product":142,"cves":143},"solidfire_baseboard_management_controller_firmware",70,{"product":145,"cves":146},"solidfire_\\&_hci_storage_node",21,{"product":148,"cves":149},"solidfire_bios",16,{"product":151,"cves":152},"solidfire_element_os_management_node",3,{"product":154,"cves":152},"solidfire_enterprise_sds",{"product":156,"cves":152},"solidfire_element_os",{"rows":158,"total":11,"capped":31,"failed":9},[159,163,167,171,175],{"cveId":71,"name":83,"severity":23,"cvss":21,"added":84,"epss":74,"published":160,"ranges":161,"checked":4,"hits":162,"covers":31},"2021-07-07T12:15:08.453",[],[],{"cveId":18,"name":88,"severity":23,"cvss":21,"added":89,"epss":24,"published":164,"ranges":165,"checked":4,"hits":166,"covers":31},"2021-01-26T21:15:12.987",[],[],{"cveId":59,"name":93,"severity":23,"cvss":62,"added":94,"epss":63,"published":168,"ranges":169,"checked":4,"hits":170,"covers":31},"2016-11-10T21:59:00.197",[],[],{"cveId":97,"name":101,"severity":23,"cvss":21,"added":102,"epss":100,"published":172,"ranges":173,"checked":4,"hits":174,"covers":31},"2019-07-17T13:15:10.687",[],[],{"cveId":105,"name":109,"severity":23,"cvss":21,"added":110,"epss":108,"published":176,"ranges":177,"checked":4,"hits":178,"covers":31},"2019-10-11T19:15:10.947",[],[]]