CVE-2017-14053

NetApp OnCommand Unified Manager for Clustered Data ONTAP before 7.2P1 does not set the secure flag for an unspecified cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

PT-2017-13226

Name of the Vulnerable Software and Affected Versions NetApp OnCommand Unified Manager for Clustered Data ONTAP versions prior to 7.2P1 Description The issue makes it easier for remote attackers to capture an unspecified cookie by intercepting its transmission within an HTTP session, as the secur...

CVE-2017-14053: Exposure of Sensitive Information to an Unauthorized Actor

NetApp OnCommand Unified Manager for Clustered Data ONTAP before 7.2P1 does not set the secure flag for an unspecified cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

CVE-2017-7439

NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors involving error messages...

CVE-2017-7236: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2017-7439: Exposure of Sensitive Information to an Unauthorized Actor

NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors involving error messages...

CVE-2017-7236

SQL injection vulnerability in NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2017-7236

NetApp OnCommand Unified Manager Core Package 5.x is affected by CVE-2017-7236 (pre-5.2.2P1). The vulnerability is a SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Affected component is the Core Package in OnCommand Unified Mana...

CVE-2017-7439

Affected software: NetApp OnCommand Unified Manager Core Package 5.x (pre-5.2.2P1). Vulnerability: Information disclosure due to error-message handling. Impact: Remote attackers could obtain sensitive information via vectors involving error messages. Root cause / notes: Documented as a vulnerabil...

PT-2017-17736

Name of the Vulnerable Software and Affected Versions NetApp OnCommand Unified Manager Core Package versions prior to 5.2.2P1 Description The issue might allow remote attackers to obtain sensitive information via vectors involving error messages. Recommendations For versions prior to 5.2.2P1,...

PT-2017-17598

Name of the Vulnerable Software and Affected Versions NetApp OnCommand Unified Manager Core Package versions prior to 5.2.2P1 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. Recommendations For versions prior to 5.2.2P1, update to version 5.2.2P1 or...

CVE-2017-7345: Exposure of Sensitive Information to an Unauthorized Actor

NetApp OnCommand Performance Manager and OnCommand Unified Manager for Clustered Data ONTAP before 7.1P1 improperly bind the Java Management Extension Remote Method Invocation aka JMX RMI service to the network, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2016-6667

NetApp OnCommand Unified Manager for Clustered Data ONTAP 6.3 through 6.4P1 contain a default privileged account, which allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2016-6667: Undefined Security Weakness

NetApp OnCommand Unified Manager for Clustered Data ONTAP 6.3 through 6.4P1 contain a default privileged account, which allows remote attackers to execute arbitrary code via unspecified vectors...

PT-2017-9012

Name of the Vulnerable Software and Affected Versions NetApp OnCommand Unified Manager for Clustered Data ONTAP versions 6.3 through 6.4P1 Description The issue concerns a default privileged account that allows remote attackers to execute arbitrary code. The exact vectors used for the attack are...