Code injection

NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to the "diagnostic" page using the SnapMirror log path parameter...

CVE-2013-3321

NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to the "diagnostic" page using the SnapMirror log path parameter...

CVE-2013-3321

NetApp OnCommand System Manager 2.1 and earlier is affected by CVE-2013-3321 via a Local File Inclusion path exposed in the SnapMirror log/diagnostic area. Exploitation requires authentication as root to change the diagnostic path and read arbitrary files from the file system. The vulnerability i...

CVE-2013-3320

Cross-site Scripting XSS vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject arbitrary web script or HTML via the 'full-name' and 'comment' fields...

CVE-2013-3320

NetApp OnCommand System Manager prior to 2.2 is affected by CVE-2013-3320 (XSS) via the full-name and comment fields. The SEC Consult advisory indicates vulnerable versions are <= 2.1 and

PT-2020-7434

Name of the Vulnerable Software and Affected Versions: NetApp OnCommand System Manager versions prior to 2.2 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the full-name and comment fields, enabling Cross-site Scripting XSS attacks. Recommendations: For...

PT-2020-7435

Name of the Vulnerable Software and Affected Versions: NetApp OnCommand System Manager versions 2.1 and earlier Description: The issue allows remote attackers to include arbitrary files through specially crafted requests to the "diagnostic" page using the SnapMirror log path parameter. This can b...

CVE-2013-3321: Inclusion of Functionality from Untrusted Control Sphere

NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to the "diagnostic" page using the SnapMirror log path parameter...

CVE-2013-3320: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject arbitrary web script or HTML via the 'full-name' and 'comment' fields...

NetApp Clustered Data ONTAP 9.2 Vulnerability - Lenovo Support US

Lenovo Security Advisory: LEN-29588 Potential Impact: Denial of Service Severity: Medium Scope of Impact: Industry-wide CVE Identifier: CVE-2019-5508 Summary Description: NetApp reported that Clustered Data ONTAP versions 9.2 through 9.4 are susceptible to a vulnerability which allows an attacker...

NetApp Clustered Data ONTAP 9.2 Vulnerability - Lenovo Support US

No description provided...

Deserialized Double Dirty

Recently I was able to fully root a NetApp OnCommand Performance Manager appliance using a Java Deserialization vulnerability and Dirty COW...

NetApp Clustered Data ONTAP Trust Management Issue Vulnerability

NetApp Clustered Data ONTAP is a set of storage operating system for clustered mode from the American company NetApp. A trust management issue vulnerability exists in NetApp Clustered Data ONTAP 9.0 and later versions, which arises from the lack of an effective trust management mechanism in a...

NetApp ONTAP Select Deploy Elevation of Privilege Vulnerability

ONTAP Select Deploy is a management utility for deploying and managing ONTAP Select clusters. An elevation of privilege vulnerability exists in ONTAP Select Deploy. An attacker could exploit this vulnerability to achieve elevation of privilege...

NetApp ONTAP Select Deploy Code Injection Vulnerability

ONTAP Select Deploy is a management utility for deploying and managing ONTAP Select clusters. A code injection vulnerability exists in ONTAP Select Deploy. An attacker could exploit the vulnerability to enable and use privileged user accounts...

NetApp SnapManager for Oracle Information Disclosure Vulnerability

NetApp SnapManager for Oracle is an administrative tool for Oracle databases from NetApp, USA. The product provides features such as enforcing policy-driven data management, scheduling and creating routine database backups. An information disclosure vulnerability exists in NetApp SnapManager for...

Secondary storage backup stops working after NetApp MetroCluster switchover

Challenge After the MetroCluster switchover a backup job with the SnapVault or SnapMirror specified on the Secondary Target tab cannot update these relationships. Cause Unfortunately this is a bug in the OnTap Data Management software. In the event of a switchover Veeam Backup&Replication cannot...

Missing HTTP Security Headers in NetApp OnCommand Workflow Automation - US

Lenovo Security Advisory: LEN-29480 Potential Impact: Information Disclosure Severity: Medium Scope of Impact: Industry-wide CVE Identifier: CVE-2019-5503 Summary Description: NetApp reported that OnCommand Workflow Automation versions prior to 5.0 shipped without certain HTTP Security headers...

Missing HTTP Security Headers in NetApp OnCommand Workflow Automation - Lenovo Support US

No description provided...

NetApp Clustered Data ONTAP Denial of Service Vulnerability (CNVD-2019-39576)

NetApp Clustered Data ONTAP is a set of storage operating system for clustered mode from the American company NetApp. A denial of service vulnerability exists in NetApp Clustered Data ONTAP versions 9.2 through 9.6, which can be exploited to cause a denial of service via l2ping...