InfoSec Signals™
Sign InStart Free

CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,470 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

Published in the last 7 days
5,470
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list
Clear

Showing CVEs that name the product netapp:oncommand_workflow_automation. Show all products

51 CVEs, showing 1 to 50Page 1 of 2Next
CVESeverityTitlePublished
CVE-2016-3427
Known exploited
Critical 9.8Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vector…
Assigned by oracle
Apr 21, 2016
CVE-2017-5645Critical 9.8In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
Assigned by apache
Apr 17, 2017
CVE-2016-9841Critical 9.8inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
Assigned by microfocus
May 23, 2017
CVE-2017-12617
Known exploited
High 8.1When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.
Assigned by apache
Oct 3, 2017
CVE-2018-1258
Healthcare
High 8.8Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security.
Assigned by dell
May 11, 2018
CVE-2018-8014Critical 9.8The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all ori…
Assigned by apache
May 16, 2018
CVE-2018-11212Medium 6.5An issue was discovered in libjpeg 9a and 9d.
Assigned by mitre
May 16, 2018
CVE-2018-11776
Known exploited
High 8.1Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then:…
Assigned by apache
Aug 22, 2018
CVE-2018-14718Critical 9.8FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
Assigned by mitre
Jan 2, 2019
CVE-2018-14719Critical 9.8FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deseriali…
Assigned by mitre
Jan 2, 2019
CVE-2019-5443High 7.8A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine")…
Assigned by hackerone
Jul 2, 2019
CVE-2019-14379Critical 9.8SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), lead…
Assigned by mitre
Jul 29, 2019
CVE-2019-16168Medium 6.5In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the…
Assigned by mitre
Sep 9, 2019
CVE-2019-14540Critical 9.8A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
Assigned by mitre
Sep 15, 2019
CVE-2019-16335Critical 9.8A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
Assigned by mitre
Sep 15, 2019
CVE-2019-5482Critical 9.8Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
Assigned by hackerone
Sep 16, 2019
CVE-2019-16942Critical 9.8A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
Assigned by mitre
Oct 1, 2019
CVE-2019-16943Critical 9.8A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.Oct 1, 2019
CVE-2019-17267Critical 9.8A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.Oct 7, 2019
CVE-2019-17531Critical 9.8A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
Assigned by mitre
Oct 12, 2019
CVE-2020-8840Critical 9.8FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
Assigned by mitre
Feb 10, 2020
CVE-2020-1967High 7.5Segmentation fault in SSL_check_chain
Assigned by openssl
Apr 21, 2020
CVE-2020-10878High 8.6Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation.
Assigned by mitre
Jun 5, 2020
CVE-2020-12723High 7.5regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.
Assigned by mitre
Jun 5, 2020
CVE-2020-28196High 7.5MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite l…
Assigned by mitre
Nov 6, 2020
CVE-2020-25649High 7.5A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.
Assigned by redhat
Dec 3, 2020
CVE-2021-21295Medium 5.9Possible request smuggling in HTTP/2 due missing validation
Assigned by GitHub_M
Mar 9, 2021
CVE-2021-3449Medium 5.9NULL pointer deref in signature_algorithms processing
Assigned by openssl
Mar 25, 2021
CVE-2021-3450High 7.4CA certificate check bypass with X509_V_FLAG_X509_STRICT
Assigned by openssl
Mar 25, 2021
CVE-2021-21409Medium 5.9Possible request smuggling in HTTP/2 due missing validation of content-length
Assigned by GitHub_M
Mar 30, 2021
CVE-2021-3517High 8.6There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11.
Assigned by redhat
May 19, 2021
CVE-2021-22901High 8.1curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection.
Assigned by hackerone
Jun 11, 2021
CVE-2021-36222High 7.5ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference…
Assigned by mitre
Jul 22, 2021
CVE-2021-22926High 7.5libcurl-using applications can ask for a specific client certificate to be used in a transfer.
Assigned by hackerone
Aug 5, 2021
CVE-2021-3711Critical 9.8SM2 Decryption Buffer Overflow
Assigned by openssl
Aug 24, 2021
CVE-2021-22946High 7.5A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSES…
Assigned by hackerone
Sep 29, 2021
CVE-2021-43797Medium 6.5HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling
Assigned by GitHub_M
Dec 9, 2021
CVE-2021-45960High 8.8In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memo…
Assigned by mitre
Jan 1, 2022
CVE-2021-46143High 8.1In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
Assigned by mitre
Jan 6, 2022
CVE-2022-23852Critical 9.8Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
Assigned by mitre
Jan 24, 2022
CVE-2018-25032High 7.5zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
Assigned by mitre
Mar 25, 2022
CVE-2022-1292Critical 9.8The c_rehash script allows command injection
Assigned by openssl
May 3, 2022
CVE-2022-27778High 8.1A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.
Assigned by hackerone
Jun 1, 2022
CVE-2022-37434Critical 9.8zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field.
Assigned by mitre
Aug 5, 2022
CVE-2022-42003High 7.5In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting,…Oct 2, 2022
CVE-2022-42004High 7.5In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays.Oct 2, 2022
CVE-2022-43680High 7.5In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.
Assigned by mitre
Oct 24, 2022
CVE-2022-43551High 7.5A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP.
Assigned by hackerone
Dec 23, 2022
CVE-2023-41993
Known exploited
High 8.8The issue was addressed with improved checks.
Assigned by apple
Sep 21, 2023
CVE-2024-1635High 7.5A vulnerability was found in Undertow.Feb 19, 2024
Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.