CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,470 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,470
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product netapp:active_iq_unified_manager. Show all products

135 CVEs, showing 1 to 50Page 1 of 3Next
CVESeverityTitlePublished
CVE-2016-10165High 7.1The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which…
Assigned by mitre
Feb 3, 2017
CVE-2016-9841Critical 9.8inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
Assigned by microfocus
May 23, 2017
CVE-2017-12617
Known exploited
High 8.1When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.
Assigned by apache
Oct 3, 2017
CVE-2018-11776
Known exploited
High 8.1Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then:…
Assigned by apache
Aug 22, 2018
CVE-2019-13272
Known exploited
High 7.8In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obta…
Assigned by mitre
Jul 17, 2019
CVE-2019-14379Critical 9.8SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), lead…
Assigned by mitre
Jul 29, 2019
CVE-2019-15219Medium 4.6An issue was discovered in the Linux kernel before 5.1.8.
Assigned by mitre
Aug 19, 2019
CVE-2019-15218Medium 4.6An issue was discovered in the Linux kernel before 5.1.8.
Assigned by mitre
Aug 19, 2019
CVE-2019-15217Medium 4.6An issue was discovered in the Linux kernel before 5.2.3.
Assigned by mitre
Aug 19, 2019
CVE-2019-16168Medium 6.5In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the…
Assigned by mitre
Sep 9, 2019
CVE-2019-16942Critical 9.8A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
Assigned by mitre
Oct 1, 2019
CVE-2019-16943Critical 9.8A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.Oct 1, 2019
CVE-2019-17267Critical 9.8A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.Oct 7, 2019
CVE-2019-17498High 8.1In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a s…
Assigned by mitre
Oct 21, 2019
CVE-2019-10219
Healthcare
Medium 6.5A vulnerability was found in Hibernate-Validator.
Assigned by redhat
Nov 8, 2019
CVE-2019-19054Medium 4.7A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by tri…
Assigned by mitre
Nov 18, 2019
CVE-2019-19462Medium 5.5relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result.
Assigned by mitre
Nov 30, 2019
CVE-2019-19956High 7.5xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
Assigned by mitre
Dec 24, 2019
CVE-2019-19965Medium 4.7In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race…
Assigned by mitre
Dec 25, 2019
CVE-2019-20095Medium 5.5mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82.
Assigned by mitre
Dec 30, 2019
CVE-2019-20330Critical 9.8FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
Assigned by mitre
Jan 3, 2020
CVE-2019-9674High 7.5Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.
Assigned by mitre
Feb 4, 2020
CVE-2020-9548Critical 9.8FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
Assigned by mitre
Mar 2, 2020
CVE-2020-9546Critical 9.8FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hika…Mar 2, 2020
CVE-2020-9547Critical 9.8FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibati…Mar 2, 2020
CVE-2020-10029Medium 5.5The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen…
Assigned by mitre
Mar 4, 2020
CVE-2020-11619High 8.1FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop…
Assigned by mitre
Apr 7, 2020
CVE-2020-11620High 8.1FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
Assigned by mitre
Apr 7, 2020
CVE-2020-1967High 7.5Segmentation fault in SSL_check_chain
Assigned by openssl
Apr 21, 2020
CVE-2020-11023
Known exploited
Healthcare
Medium 6.9Potential XSS vulnerability in jQuery
Assigned by GitHub_M
Apr 29, 2020
CVE-2020-1752High 7.0A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out.
Assigned by redhat
Apr 30, 2020
CVE-2020-12769Medium 5.5An issue was discovered in the Linux kernel before 5.4.17.
Assigned by mitre
May 9, 2020
CVE-2020-13776Medium 6.7systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user acc…
Assigned by mitre
Jun 3, 2020
CVE-2020-14062High 8.1FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2…
Assigned by mitre
Jun 14, 2020
CVE-2020-14060High 8.1FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).
Assigned by mitre
Jun 14, 2020
CVE-2020-14155Medium 5.3libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
Assigned by mitre
Jun 15, 2020
CVE-2020-14195High 8.1FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
Assigned by mitre
Jun 16, 2020
CVE-2020-14145Medium 5.9The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation.
Assigned by mitre
Jun 29, 2020
CVE-2019-20907Medium 5.5In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
Assigned by mitre
Jul 13, 2020
CVE-2020-15778High 7.8scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument.
Assigned by mitre
Jul 24, 2020
CVE-2020-24616High 8.1FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
Assigned by mitre
Aug 25, 2020
CVE-2020-24977Medium 6.5GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c.
Assigned by mitre
Sep 3, 2020
CVE-2020-28196High 7.5MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite l…
Assigned by mitre
Nov 6, 2020
CVE-2020-13956Medium 5.3Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host…
Assigned by apache
Dec 2, 2020
CVE-2021-3177Critical 9.8Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untru…
Assigned by mitre
Jan 19, 2021
CVE-2021-3156
Known exploited
High 7.8Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends wit…
Assigned by mitre
Jan 26, 2021
CVE-2021-21290Medium 6.2Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files
Assigned by GitHub_M
Feb 8, 2021
CVE-2021-23337High 7.2Command Injection
Assigned by snyk
Feb 15, 2021
CVE-2021-27218High 7.5An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4.
Assigned by mitre
Feb 15, 2021
CVE-2021-27219High 7.5An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3.
Assigned by mitre
Feb 15, 2021
Page 1 of 3Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.