EUVD-2017-5567

Malware in sbrugna...

CVE-2017-7568: Exposure of Sensitive Information to an Unauthorized Actor

NetApp OnCommand Unified Manager for 7-Mode core package versions prior to 5.2.3 may disclose sensitive LDAP account information to authenticated users when the LDAP authentication configuration is tested via the user interface...

PT-2018-8408

Name of the Vulnerable Software and Affected Versions NetApp OnCommand Unified Manager for 7-Mode core package versions prior to 5.2.3 Description The issue may disclose sensitive LDAP account information to authenticated users when the LDAP authentication configuration is tested via the user...

PT-2018-16987

Name of the Vulnerable Software and Affected Versions NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 Description The issue concerns the Java Management Extension Remote Method Invocation JMX RMI service, which is bound to the network in the affected versions, making them...

CVE-2018-5485: Undefined Security Weakness

NetApp OnCommand Unified Manager for Windows versions 7.2 through 7.3 are susceptible to a vulnerability which could lead to a privilege escalation attack...

PT-2018-16985

Name of the Vulnerable Software and Affected Versions NetApp OnCommand Unified Manager for Windows versions 7.2 through 7.3 Description The issue could lead to a privilege escalation attack. Recommendations For versions 7.2 through 7.3, update to a version that contains a fix for this issue...

CVE-2018-5487: Improper Input Validation

NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation JMX RMI service bound to the network, and are susceptible to unauthenticated remote code execution...

CVE-2018-5486

NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol JDWP enabled which allows unauthorized local attackers to execute arbitrary code...

PT-2018-16986

Name of the Vulnerable Software and Affected Versions NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 Description The issue allows unauthorized local attackers to execute arbitrary code due to the Java Debug Wire Protocol JDWP being enabled. Recommendations For versions 7.2...

CVE-2018-5486: Missing Authentication for Critical Function

NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol JDWP enabled which allows unauthorized local attackers to execute arbitrary code...

CVE-2017-11461: Improper Input Validation

NetApp OnCommand Unified Manager for 7-mode core package versions prior to 5.2.1 are susceptible to a clickjacking or "UI redress attack" which could be used to cause a user to perform an unintended action in the user interface...

PT-2017-12030

Name of the Vulnerable Software and Affected Versions NetApp OnCommand Unified Manager for 7-mode core package versions prior to 5.2.1 Description The issue allows for a clickjacking or "UI redress attack" that could cause a user to perform an unintended action in the user interface...

CVE-2017-14053

NetApp OnCommand Unified Manager for Clustered Data ONTAP before 7.2P1 does not set the secure flag for an unspecified cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

PT-2017-13226

Name of the Vulnerable Software and Affected Versions NetApp OnCommand Unified Manager for Clustered Data ONTAP versions prior to 7.2P1 Description The issue makes it easier for remote attackers to capture an unspecified cookie by intercepting its transmission within an HTTP session, as the secur...

CVE-2017-14053: Exposure of Sensitive Information to an Unauthorized Actor

NetApp OnCommand Unified Manager for Clustered Data ONTAP before 7.2P1 does not set the secure flag for an unspecified cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

NetApp OnCommand Unified Manager Core Package Information Disclosure Vulnerability

NetApp OnCommand Unified Manager Core Package is an OnCommand series of management software from American NetApp. A security vulnerability exists in NetApp OnCommand Unified Manager Core Package. A remote attacker could exploit the vulnerability to obtain sensitive information...

CVE-2017-7439: Exposure of Sensitive Information to an Unauthorized Actor

NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors involving error messages...

CVE-2017-7236: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2017-7236

NetApp OnCommand Unified Manager Core Package 5.x is affected by CVE-2017-7236 (pre-5.2.2P1). The vulnerability is a SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Affected component is the Core Package in OnCommand Unified Mana...

PT-2017-17736

Name of the Vulnerable Software and Affected Versions NetApp OnCommand Unified Manager Core Package versions prior to 5.2.2P1 Description The issue might allow remote attackers to obtain sensitive information via vectors involving error messages. Recommendations For versions prior to 5.2.2P1,...