CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,443 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,443
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product netapp:oncommand_insight. Show all products

56 CVEs, showing 1 to 50Page 1 of 2Next
CVESeverityTitlePublished
CVE-2023-44487
Known exploited
High 7.5The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Assigned by mitre
Oct 10, 2023
CVE-2023-41993
Known exploited
High 8.8The issue was addressed with improved checks.
Assigned by apple
Sep 21, 2023
CVE-2022-43551High 7.5A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP.
Assigned by hackerone
Dec 23, 2022
CVE-2022-2097Medium 5.3AES OCB fails to encrypt some bytes
Assigned by openssl
Jul 5, 2022
CVE-2022-27778High 8.1A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.
Assigned by hackerone
Jun 1, 2022
CVE-2022-22971Medium 6.5In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated…
Assigned by vmware
May 12, 2022
CVE-2022-22970Medium 5.3In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a Multipar…
Assigned by vmware
May 12, 2022
CVE-2022-1292Critical 9.8The c_rehash script allows command injection
Assigned by openssl
May 3, 2022
CVE-2021-44228
Known exploited
Critical 10.0Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
Assigned by apache
Dec 10, 2021
CVE-2021-37137High 7.5The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.
Assigned by JFROG
Oct 19, 2021
CVE-2021-37136High 7.5The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).
Assigned by JFROG
Oct 19, 2021
CVE-2021-22946High 7.5A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSES…
Assigned by hackerone
Sep 29, 2021
CVE-2021-3711Critical 9.8SM2 Decryption Buffer Overflow
Assigned by openssl
Aug 24, 2021
CVE-2021-22926High 7.5libcurl-using applications can ask for a specific client certificate to be used in a transfer.
Assigned by hackerone
Aug 5, 2021
CVE-2021-36222High 7.5ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference…
Assigned by mitre
Jul 22, 2021
CVE-2021-36090
Healthcare
High 7.5Apache Commons Compress 1.0 to 1.20 denial of service vulnerability
Assigned by apache
Jul 13, 2021
CVE-2021-35517
Healthcare
High 7.5Apache Commons Compress 1.1 to 1.20 denial of service vulnerability
Assigned by apache
Jul 13, 2021
CVE-2021-35516
Healthcare
High 7.5Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
Assigned by apache
Jul 13, 2021
CVE-2021-35515
Healthcare
High 7.5Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
Assigned by apache
Jul 13, 2021
CVE-2021-22901High 8.1curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection.
Assigned by hackerone
Jun 11, 2021
CVE-2021-3517High 8.6There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11.
Assigned by redhat
May 19, 2021
CVE-2021-3449Medium 5.9NULL pointer deref in signature_algorithms processing
Assigned by openssl
Mar 25, 2021
CVE-2021-21351Critical 9.1XStream is a Java library to serialize objects to XML and back again.Mar 23, 2021
CVE-2021-21350Critical 9.8XStream is a Java library to serialize objects to XML and back again.Mar 23, 2021
CVE-2021-21349High 8.6XStream is a Java library to serialize objects to XML and back again.Mar 23, 2021
CVE-2021-21348High 7.5XStream is a Java library to serialize objects to XML and back again.Mar 23, 2021
CVE-2021-21347Critical 9.8XStream is a Java library to serialize objects to XML and back again.Mar 23, 2021
CVE-2021-21346Critical 9.8XStream is a Java library to serialize objects to XML and back again.Mar 23, 2021
CVE-2021-21345Critical 9.9XStream is a Java library to serialize objects to XML and back again.Mar 23, 2021
CVE-2021-21344Critical 9.8XStream is a Java library to serialize objects to XML and back again.Mar 23, 2021
CVE-2021-21343High 7.5XStream is a Java library to serialize objects to XML and back again.Mar 23, 2021
CVE-2021-21342Critical 9.1XStream is a Java library to serialize objects to XML and back again.Mar 23, 2021
CVE-2021-21341High 7.5XStream is a Java library to serialize objects to XML and back again.Mar 23, 2021
CVE-2020-28196High 7.5MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite l…
Assigned by mitre
Nov 6, 2020
CVE-2020-5421
Healthcare
High 8.7RFD Protection Bypass via jsessionid
Assigned by pivotal
Sep 19, 2020
CVE-2020-11022
Healthcare
Medium 6.9jQuery has a potential XSS vulnerability
Assigned by GitHub_M
Apr 29, 2020
CVE-2020-11023
Known exploited
Healthcare
Medium 6.9Potential XSS vulnerability in jQuery
Assigned by GitHub_M
Apr 29, 2020
CVE-2020-1967High 7.5Segmentation fault in SSL_check_chain
Assigned by openssl
Apr 21, 2020
CVE-2019-5482Critical 9.8Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
Assigned by hackerone
Sep 16, 2019
CVE-2019-16168Medium 6.5In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the…
Assigned by mitre
Sep 9, 2019
CVE-2019-5443High 7.8A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine")…
Assigned by hackerone
Jul 2, 2019
CVE-2018-11776
Known exploited
High 8.1Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then:…
Assigned by apache
Aug 22, 2018
CVE-2018-8014Critical 9.8The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all ori…
Assigned by apache
May 16, 2018
CVE-2018-1258
Healthcare
High 8.8Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security.
Assigned by dell
May 11, 2018
CVE-2017-12617
Known exploited
High 8.1When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.
Assigned by apache
Oct 3, 2017
CVE-2016-6796High 7.5A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via…
Assigned by apache
Aug 11, 2017
CVE-2016-6797High 7.5The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global J…
Assigned by apache
Aug 10, 2017
CVE-2016-6794Medium 5.3When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager.
Assigned by apache
Aug 10, 2017
CVE-2016-5018Critical 9.1In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomca…
Assigned by apache
Aug 10, 2017
CVE-2016-0762Medium 5.9The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplie…
Assigned by apache
Aug 10, 2017
Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.