[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fN1SXHEag049_auRoR8bjF-jRlnjfwSU_WAXJTOys-pI":3,"g5a-family:netapp\u002Factive_iq_unified_manager":169,"g5a-ex:netapp\u002Factive_iq_unified_manager@*":172},{"success":4,"data":5},true,{"product":6,"versions":28,"topVulnerabilitiesByEpss":34,"kevVulnerabilities":96,"seoMetadata":147,"meta":166},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":27},"netapp","active_iq_unified_manager",5,827,9,"2025-02-18",[14,18,21,23,25],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"7.3",0,false,{"version":19,"cve_count":20,"kev_count":16,"has_kev":17},"9.10",1,{"version":22,"cve_count":16,"kev_count":16,"has_kev":17},"9.11p1",{"version":24,"cve_count":16,"kev_count":16,"has_kev":17},"9.5",{"version":26,"cve_count":20,"kev_count":16,"has_kev":17},"9.6","Active Iq Unified Manager by Netapp is a technology product with 5 tracked versions and 827 known security vulnerabilities including 9 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[29,30,31,32,33],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},{"version":19,"cve_count":20,"kev_count":16,"has_kev":17},{"version":22,"cve_count":16,"kev_count":16,"has_kev":17},{"version":24,"cve_count":16,"kev_count":16,"has_kev":17},{"version":26,"cve_count":20,"kev_count":16,"has_kev":17},[35,43,50,56,61,67,72,78,85,90],{"cveId":36,"description":37,"publishedDate":38,"cvssScore":39,"cvssVersion":40,"severity":41,"isKev":4,"epssScore":42},"CVE-2021-44228","Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","2021-12-10",10,"v3.1","Critical",0.99999,{"cveId":44,"description":45,"publishedDate":46,"cvssScore":47,"cvssVersion":40,"severity":48,"isKev":4,"epssScore":49},"CVE-2018-11776","Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.","2018-08-22",8.1,"High",0.99996,{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":40,"severity":48,"isKev":4,"epssScore":55},"CVE-2023-4863","Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)","2023-09-12",8.8,0.99979,{"cveId":57,"description":58,"publishedDate":59,"cvssScore":47,"cvssVersion":40,"severity":48,"isKev":4,"epssScore":60},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",0.99968,{"cveId":62,"description":63,"publishedDate":64,"cvssScore":65,"cvssVersion":40,"severity":48,"isKev":4,"epssScore":66},"CVE-2021-3156","Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via \"sudoedit -s\" and a command-line argument that ends with a single backslash character.","2021-01-26",7.8,0.99962,{"cveId":68,"description":69,"publishedDate":70,"cvssScore":47,"cvssVersion":40,"severity":48,"isKev":17,"epssScore":71},"CVE-2024-6387","A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","2024-07-01",0.99506,{"cveId":73,"description":74,"publishedDate":75,"cvssScore":76,"cvssVersion":40,"severity":41,"isKev":17,"epssScore":77},"CVE-2021-3711","In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the \"out\" parameter can be NULL and, on exit, the \"outlen\" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the \"out\" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).","2021-08-24",9.8,0.87816,{"cveId":79,"description":80,"publishedDate":81,"cvssScore":82,"cvssVersion":40,"severity":83,"isKev":4,"epssScore":84},"CVE-2020-11023","In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003Coption> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","2020-04-29",6.9,"Medium",0.84887,{"cveId":86,"description":87,"publishedDate":88,"cvssScore":76,"cvssVersion":40,"severity":41,"isKev":17,"epssScore":89},"CVE-2021-25216","In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting values for the tkey-gssapi-keytab or tkey-gssapi-credential configuration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. For servers that meet these conditions, the ISC SPNEGO implementation is vulnerable to various attacks, depending on the CPU architecture for which BIND was built: For named binaries compiled for 64-bit platforms, this flaw can be used to trigger a buffer over-read, leading to a server crash. For named binaries compiled for 32-bit platforms, this flaw can be used to trigger a server crash due to a buffer overflow and possibly also to achieve remote code execution. We have determined that standard SPNEGO implementations are available in the MIT and Heimdal Kerberos libraries, which support a broad range of operating systems, rendering the ISC implementation unnecessary and obsolete. Therefore, to reduce the attack surface for BIND users, we will be removing the ISC SPNEGO implementation in the April releases of BIND 9.11 and 9.16 (it had already been dropped from BIND 9.17). We would not normally remove something from a stable ESV (Extended Support Version) of BIND, but since system libraries can replace the ISC SPNEGO implementation, we have made an exception in this case for reasons of stability and security.","2021-04-29",0.82992,{"cveId":91,"description":92,"publishedDate":93,"cvssScore":94,"cvssVersion":40,"severity":48,"isKev":17,"epssScore":95},"CVE-2022-1292","The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).","2022-05-03",7.3,0.82612,[97,107,111,119,123,128,132,136,143],{"cveId":98,"description":99,"publishedDate":100,"cvssScore":101,"severity":48,"isKev":4,"epssScore":102,"cisaVulnName":103,"cisaDateAdded":104,"cisaShortDescription":105,"cisaRequiredAction":106},"CVE-2025-0411","7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.","2025-01-25",7,0.67071,"7-Zip Mark of the Web Bypass Vulnerability","2025-02-06","7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":79,"description":80,"publishedDate":81,"cvssScore":82,"severity":83,"isKev":4,"epssScore":84,"cisaVulnName":108,"cisaDateAdded":109,"cisaShortDescription":110,"cisaRequiredAction":106},"JQuery Cross-Site Scripting (XSS) Vulnerability","2025-01-23","JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.",{"cveId":112,"description":113,"publishedDate":114,"cvssScore":54,"severity":48,"isKev":4,"epssScore":115,"cisaVulnName":116,"cisaDateAdded":117,"cisaShortDescription":118,"cisaRequiredAction":106},"CVE-2023-41993","The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.","2023-09-21",0.24349,"Apple Multiple Products WebKit Code Execution Vulnerability","2023-09-25","Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.",{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"severity":48,"isKev":4,"epssScore":55,"cisaVulnName":120,"cisaDateAdded":121,"cisaShortDescription":122,"cisaRequiredAction":106},"Google Chromium WebP Heap-Based Buffer Overflow Vulnerability","2023-09-13","Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.",{"cveId":62,"description":63,"publishedDate":64,"cvssScore":65,"severity":48,"isKev":4,"epssScore":66,"cisaVulnName":124,"cisaDateAdded":125,"cisaShortDescription":126,"cisaRequiredAction":127},"Sudo Heap-Based Buffer Overflow Vulnerability","2022-04-06","Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.","Apply updates per vendor instructions.",{"cveId":57,"description":58,"publishedDate":59,"cvssScore":47,"severity":48,"isKev":4,"epssScore":60,"cisaVulnName":129,"cisaDateAdded":130,"cisaShortDescription":131,"cisaRequiredAction":127},"Apache Tomcat Remote Code Execution Vulnerability","2022-03-25","When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",{"cveId":36,"description":37,"publishedDate":38,"cvssScore":39,"severity":41,"isKev":4,"epssScore":42,"cisaVulnName":133,"cisaDateAdded":38,"cisaShortDescription":134,"cisaRequiredAction":135},"Apache Log4j2 Remote Code Execution Vulnerability","Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.","For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https:\u002F\u002Fwww.cisa.gov\u002Fuscert\u002Fed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.",{"cveId":137,"description":138,"publishedDate":139,"cvssScore":65,"severity":48,"isKev":4,"epssScore":140,"cisaVulnName":141,"cisaDateAdded":38,"cisaShortDescription":142,"cisaRequiredAction":127},"CVE-2019-13272","In the Linux kernel before 5.1.17, ptrace_link in kernel\u002Fptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.","2019-07-17",0.52199,"Linux Kernel Improper Privilege Management Vulnerability","Kernel\u002Fptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.",{"cveId":44,"description":45,"publishedDate":46,"cvssScore":47,"severity":48,"isKev":4,"epssScore":49,"cisaVulnName":144,"cisaDateAdded":145,"cisaShortDescription":146,"cisaRequiredAction":127},"Apache Struts Remote Code Execution Vulnerability","2021-11-03","Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace.  Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.",{"title":148,"metaDescription":149,"keywords":150,"structuredData":151},"Active Iq Unified Manager by Netapp - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Active Iq Unified Manager by Netapp covering 5 versions with 827 tracked vulnerabilities including 1 critical and 7 high-severity issues and 9 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Active Iq Unified Manager vulnerabilities, Active Iq Unified Manager security, Active Iq Unified Manager CVE, Netapp Active Iq Unified Manager, Active Iq Unified Manager threat intelligence, Netapp security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Active Iq Unified Manager KEV, Active Iq Unified Manager exploited vulnerabilities",{"@context":152,"@type":153,"name":154,"description":149,"url":155,"manufacturer":156,"applicationCategory":160,"softwareVersion":161,"mainEntity":162},"https:\u002F\u002Fschema.org","SoftwareApplication","Active Iq Unified Manager","https:\u002F\u002Fedgeprotect.io\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fnetapp\u002Factive_iq_unified_manager",{"@type":157,"name":158,"url":159},"Organization","Netapp","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Fnetapp","Security Software","5 versions tracked",{"@type":163,"name":164,"description":165,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Active Iq Unified Manager Security Vulnerabilities","Security vulnerabilities affecting Active Iq Unified Manager by Netapp",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":167,"apiVersion":168},"2026-10-28T15:37:33.710Z","3.0",[170],{"product":171,"cves":9},"active_iq_unified_manager_for_vmware_vsphere",{"rows":173,"total":11,"capped":17,"failed":16},[174,178,182,186,190,194,200,204,208],{"cveId":98,"name":103,"severity":48,"cvss":101,"added":104,"epss":102,"published":175,"ranges":176,"checked":4,"hits":177,"covers":17},"2025-01-25T05:15:09.533",[],[],{"cveId":79,"name":108,"severity":83,"cvss":82,"added":109,"epss":84,"published":179,"ranges":180,"checked":4,"hits":181,"covers":17},"2020-04-29T21:15:11.743",[],[],{"cveId":112,"name":116,"severity":48,"cvss":54,"added":117,"epss":115,"published":183,"ranges":184,"checked":4,"hits":185,"covers":17},"2023-09-21T19:15:11.66",[],[],{"cveId":51,"name":120,"severity":48,"cvss":54,"added":121,"epss":55,"published":187,"ranges":188,"checked":4,"hits":189,"covers":17},"2023-09-12T15:15:24.327",[],[],{"cveId":62,"name":124,"severity":48,"cvss":65,"added":125,"epss":66,"published":191,"ranges":192,"checked":4,"hits":193,"covers":17},"2021-01-26T21:15:12.987",[],[],{"cveId":57,"name":129,"severity":48,"cvss":47,"added":130,"epss":60,"published":195,"ranges":196,"checked":4,"hits":199,"covers":17},"2017-10-04T01:29:02.12",[197,198],"7.3 and later","9.5 and later",[],{"cveId":36,"name":133,"severity":41,"cvss":39,"added":38,"epss":42,"published":201,"ranges":202,"checked":4,"hits":203,"covers":17},"2021-12-10T10:15:09.143",[],[],{"cveId":137,"name":141,"severity":48,"cvss":65,"added":38,"epss":140,"published":205,"ranges":206,"checked":4,"hits":207,"covers":17},"2019-07-17T13:15:10.687",[],[],{"cveId":44,"name":144,"severity":48,"cvss":47,"added":145,"epss":49,"published":209,"ranges":210,"checked":4,"hits":211,"covers":17},"2018-08-22T13:29:00.753",[197,198],[]]