[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$forX9PrW1HRXK3MPQfbMBJGhvCxHrvxdfKC0dOA3_gCE":3,"g5a-family:oracle\u002Fzfs_storage_appliance_kit":113,"g5a-ex:oracle\u002Fzfs_storage_appliance_kit@*":114},{"success":4,"data":5},true,{"product":6,"versions":17,"topVulnerabilitiesByEpss":19,"kevVulnerabilities":78,"seoMetadata":91,"meta":110},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":16},"oracle","zfs_storage_appliance_kit",1,117,3,"2025-10-21",[14],{"version":15,"cve_count":10,"kev_count":11,"has_kev":4},"8.8","Zfs Storage Appliance Kit by Oracle is a technology product with 1 tracked version and 117 known security vulnerabilities including 3 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[18],{"version":15,"cve_count":10,"kev_count":11,"has_kev":4},[20,28,35,42,49,54,59,64,69,74],{"cveId":21,"description":22,"publishedDate":23,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":27},"CVE-2021-40438","A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","2021-09-16",9,"v3.1","Critical",0.99999,{"cveId":29,"description":30,"publishedDate":31,"cvssScore":32,"cvssVersion":25,"severity":33,"isKev":4,"epssScore":34},"CVE-2020-1472","An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.\nTo exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.\nMicrosoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.\nFor guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see  How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020).\nWhen the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.\n","2020-08-17",5.5,"Medium",0.99389,{"cveId":36,"description":37,"publishedDate":38,"cvssScore":39,"cvssVersion":25,"severity":26,"isKev":40,"epssScore":41},"CVE-2021-44790","A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.","2021-12-20",9.8,false,0.9684,{"cveId":43,"description":44,"publishedDate":45,"cvssScore":46,"cvssVersion":25,"severity":47,"isKev":4,"epssScore":48},"CVE-2021-4034","A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.","2022-01-28",7.8,"High",0.94921,{"cveId":50,"description":51,"publishedDate":52,"cvssScore":39,"cvssVersion":25,"severity":26,"isKev":40,"epssScore":53},"CVE-2020-11984","Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE","2020-08-07",0.90039,{"cveId":55,"description":56,"publishedDate":52,"cvssScore":57,"cvssVersion":25,"severity":47,"isKev":40,"epssScore":58},"CVE-2020-9490","Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP\u002F2 request would result in a crash when the server actually tries to HTTP\u002F2 PUSH a resource afterwards. Configuring the HTTP\u002F2 feature via \"H2Push off\" will mitigate this vulnerability for unpatched servers.",7.5,0.88844,{"cveId":60,"description":61,"publishedDate":62,"cvssScore":39,"cvssVersion":25,"severity":26,"isKev":40,"epssScore":63},"CVE-2021-3711","In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the \"out\" parameter can be NULL and, on exit, the \"outlen\" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the \"out\" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).","2021-08-24",0.87816,{"cveId":65,"description":66,"publishedDate":67,"cvssScore":57,"cvssVersion":25,"severity":47,"isKev":40,"epssScore":68},"CVE-2022-22719","A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.","2022-03-14",0.69097,{"cveId":70,"description":71,"publishedDate":72,"cvssScore":39,"cvssVersion":25,"severity":26,"isKev":40,"epssScore":73},"CVE-2021-26691","In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow","2021-06-10",0.68289,{"cveId":75,"description":76,"publishedDate":72,"cvssScore":57,"cvssVersion":25,"severity":47,"isKev":40,"epssScore":77},"CVE-2021-26690","Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service",0.65308,[79,84,87],{"cveId":43,"description":44,"publishedDate":45,"cvssScore":46,"severity":47,"isKev":4,"epssScore":48,"cisaVulnName":80,"cisaDateAdded":81,"cisaShortDescription":82,"cisaRequiredAction":83},"Red Hat Polkit Out-of-Bounds Read and Write Vulnerability","2022-06-27","The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.","Apply updates per vendor instructions.",{"cveId":21,"description":22,"publishedDate":23,"cvssScore":24,"severity":26,"isKev":4,"epssScore":27,"cisaVulnName":85,"cisaDateAdded":86,"cisaShortDescription":22,"cisaRequiredAction":83},"Apache HTTP Server-Side Request Forgery (SSRF)","2021-12-01",{"cveId":29,"description":30,"publishedDate":31,"cvssScore":32,"severity":33,"isKev":4,"epssScore":34,"cisaVulnName":88,"cisaDateAdded":89,"cisaShortDescription":90,"cisaRequiredAction":83},"Microsoft Netlogon Privilege Escalation Vulnerability","2021-11-03","Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.",{"title":92,"metaDescription":93,"keywords":94,"structuredData":95},"Zfs Storage Appliance Kit by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Zfs Storage Appliance Kit by Oracle covering 1 version with 117 tracked vulnerabilities including 1 critical and 1 high-severity issues and 3 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Zfs Storage Appliance Kit vulnerabilities, Zfs Storage Appliance Kit security, Zfs Storage Appliance Kit CVE, Oracle Zfs Storage Appliance Kit, Zfs Storage Appliance Kit threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Zfs Storage Appliance Kit KEV, Zfs Storage Appliance Kit exploited vulnerabilities",{"@context":96,"@type":97,"name":98,"description":93,"url":99,"manufacturer":100,"applicationCategory":104,"softwareVersion":105,"mainEntity":106},"https:\u002F\u002Fschema.org","SoftwareApplication","Zfs Storage Appliance Kit","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fzfs_storage_appliance_kit",{"@type":101,"name":102,"url":103},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","1 versions tracked",{"@type":107,"name":108,"description":109,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Zfs Storage Appliance Kit Security Vulnerabilities","Security vulnerabilities affecting Zfs Storage Appliance Kit by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":111,"apiVersion":112},"2026-10-17T14:49:39.213Z","3.0",[],{"rows":115,"total":11,"capped":40,"failed":128},[116,120,124],{"cveId":43,"name":80,"severity":47,"cvss":46,"added":81,"epss":48,"published":117,"ranges":118,"checked":4,"hits":119,"covers":40},"2022-01-28T20:15:12.193",[15],[],{"cveId":21,"name":85,"severity":26,"cvss":24,"added":86,"epss":27,"published":121,"ranges":122,"checked":4,"hits":123,"covers":40},"2021-09-16T15:15:07.633",[15],[],{"cveId":29,"name":88,"severity":33,"cvss":32,"added":89,"epss":34,"published":125,"ranges":126,"checked":4,"hits":127,"covers":40},"2020-08-17T19:15:15.117",[15],[],0]