EUVD-2017-5567

Malware in sbrugna...

CVE-2017-7568: Exposure of Sensitive Information to an Unauthorized Actor

NetApp OnCommand Unified Manager for 7-Mode core package versions prior to 5.2.3 may disclose sensitive LDAP account information to authenticated users when the LDAP authentication configuration is tested via the user interface...

PT-2018-16987

Name of the Vulnerable Software and Affected Versions NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 Description The issue concerns the Java Management Extension Remote Method Invocation JMX RMI service, which is bound to the network in the affected versions, making them...

CVE-2018-5485: Undefined Security Weakness

NetApp OnCommand Unified Manager for Windows versions 7.2 through 7.3 are susceptible to a vulnerability which could lead to a privilege escalation attack...

CVE-2018-5487: Improper Input Validation

NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation JMX RMI service bound to the network, and are susceptible to unauthenticated remote code execution...

CVE-2018-5486

NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol JDWP enabled which allows unauthorized local attackers to execute arbitrary code...

CVE-2018-5486: Missing Authentication for Critical Function

NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol JDWP enabled which allows unauthorized local attackers to execute arbitrary code...

CVE-2017-11461: Improper Input Validation

NetApp OnCommand Unified Manager for 7-mode core package versions prior to 5.2.1 are susceptible to a clickjacking or "UI redress attack" which could be used to cause a user to perform an unintended action in the user interface...

CVE-2017-14053

NetApp OnCommand Unified Manager for Clustered Data ONTAP before 7.2P1 does not set the secure flag for an unspecified cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

CVE-2017-14053: Exposure of Sensitive Information to an Unauthorized Actor

NetApp OnCommand Unified Manager for Clustered Data ONTAP before 7.2P1 does not set the secure flag for an unspecified cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

CVE-2017-7236: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2017-7439: Exposure of Sensitive Information to an Unauthorized Actor

NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors involving error messages...

CVE-2017-7236

NetApp OnCommand Unified Manager Core Package 5.x is affected by CVE-2017-7236 (pre-5.2.2P1). The vulnerability is a SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Affected component is the Core Package in OnCommand Unified Mana...

CVE-2017-7345: Exposure of Sensitive Information to an Unauthorized Actor

NetApp OnCommand Performance Manager and OnCommand Unified Manager for Clustered Data ONTAP before 7.1P1 improperly bind the Java Management Extension Remote Method Invocation aka JMX RMI service to the network, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2016-6667

NetApp OnCommand Unified Manager for Clustered Data ONTAP 6.3 through 6.4P1 contain a default privileged account, which allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2016-6667: Undefined Security Weakness

NetApp OnCommand Unified Manager for Clustered Data ONTAP 6.3 through 6.4P1 contain a default privileged account, which allows remote attackers to execute arbitrary code via unspecified vectors...