Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

849 records

Vendor: NetApp Component: Active Iq Unified Manager Clear all filters
TI-2025-22816 CVE-2025-31672 · GHSA-gmg8-593g-7mv3

Improper input validation in Apache POI

Priority LOW 33

Improper Input Validation vulnerability in Apache POI.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01382 Published 2025-04-09 Partial fix · 5.4.0 CWE-20
TI-2025-18627 CVE-2025-24928 · GHSA-fgfv-9xqc-v794

Stack-based buffer overflow in xmlsoft libxml2

Priority LOW 36

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c.

CVSS 3.1HIGH 7.8 Local No auth No interaction EPSS 0.00385 Published 2025-02-18 Partial fix · 2.12.10, 2.13.6 CWE-121
TI-2024-37146 CVE-2024-56171 · GHSA-m366-8h8r-6fqr

Use after free in xmlsoft libxml2

Priority MEDIUM 45

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01178 Published 2025-02-18 Partial fix · 2.12.10, 2.13.6 CWE-416
TI-2025-00330 CVE-2025-0411 · GHSA-2pjx-wvcg-vhr8

Protection mechanism failure in 7-Zip

Priority CRITICAL 90KEV

7-Zip Mark-of-the-Web Bypass Vulnerability.

CVSS 3.1HIGH 7.0 Local No auth User interaction EPSS 0.47574 Published 2025-01-25 No fix listed CWE-693
TI-2025-15462 CVE-2025-21502 · GHSA-46mv-5cpj-wjxv

Incorrect authorization in Oracle Java SE

Priority LOW 24

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00986 Published 2025-01-21 Partial fix CWE-863
TI-2024-09116 CVE-2024-9823 · GHSA-j26w-f9rq-mr2q

Jetty DOS vulnerability on DosFilter

Priority MEDIUM 41

There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0094 Published 2024-10-14 Partial fix · 9.4.54, 10.0.18 +2 CWE-400
TI-2024-06719 CVE-2024-7254 · GHSA-735f-pc8j-v9w8

Stack overflow in Protocol Buffers Java Lite

Priority MEDIUM 49

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.02772 Published 2024-09-19 Partial fix · 28.2, 3.25.5 +2 CWE-400
TI-2024-07508 CVE-2024-8096 · GHSA-gv3v-x3f3-7fxm

OCSP stapling bypass with GnuTLS

Priority LOW 36

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly co…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00817 Published 2024-09-11 Will not fix CWE-295
TI-2024-07764 CVE-2024-8373 · GHSA-mqm9-c95h-x2p6

AngularJS improper sanitization in '<source>' element

Priority MEDIUM 55

Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://o…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00635 Published 2024-09-09 No fix listed CWE-791
TI-2024-07763 CVE-2024-8372 · GHSA-m9gf-397r-hwpg

AngularJS improper sanitization in 'srcset' attribute

Priority MEDIUM 55

Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/att…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00609 Published 2024-09-09 No fix listed CWE-1289
TI-2024-05670 CVE-2024-6119 · GHSA-7m4m-pwhv-49c5

Possible denial of service in X.509 name checks

Priority HIGH 75

Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.66582 Published 2024-09-03 Partial fix · 3.3.2, 3.2.3 +2 CWE-843
TI-2024-26035 CVE-2024-38808 · GHSA-9cmq-m9j5-mvww

CVE-2024-38808: Spring Expression DoS Vulnerability

Priority LOW 21

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) c…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00568 Published 2024-08-20 Partial fix · 5.3.39, 6.0+ CWE-770
TI-2024-13938 CVE-2024-21147 · GHSA-hw83-24q6-v392

Information disclosure in Oracle Java SE JDK and JRE

Priority LOW 37

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.01127 Published 2024-07-16 Partial fix CWE-200
TI-2024-13931 CVE-2024-21140 · GHSA-7prq-r42m-wfcx

Information disclosure in Oracle Java SE JDK and JRE

Priority LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.0094 Published 2024-07-16 Partial fix CWE-200
Load more