Netapp Data Ontap vulnerabilities

CVE-2021-26989 [MEDIUM] CVE-2021-26989: Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P9 and 9.8 are susceptible to a vu Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P9 and 9.8 are susceptible to a vulnerability which could allow a remote authenticated attacker to cause a Denial of Service (DoS) on clustered Data ONTAP configured for SMB access.

CVE-2021-26988 [LOW] CWE-862 CVE-2021-26988: Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P8 and 9.8 are susceptible to a vu Clustered Data ONTAP versions prior to 9.3P21, 9.5P16, 9.6P12, 9.7P8 and 9.8 are susceptible to a vulnerability which could allow unauthorized tenant users to discover information related to converting a 7-Mode directory to Cluster-mode such as Storage Virtual Machine (SVM) names, volume names, directory paths and Job IDs.

CVE-2019-5502 [CRITICAL] CWE-327 CVE-2019-5502: SMB in Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 has weak cryptography which when exp SMB in Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 has weak cryptography which when exploited could lead to information disclosure or addition or modification of data.

CVE-2019-5493 [HIGH] CVE-2019-5493: Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 are susceptible to a vulnerability which di Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 are susceptible to a vulnerability which discloses information to an unauthenticated attacker. A successful attack requires that multiple non-default options be enabled.

CVE-2019-5501 [HIGH] CVE-2019-5501: Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 may disclose sensitive LDAP account informa Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 may disclose sensitive LDAP account information to unauthenticated remote attackers.

CVE-2018-5496 [MEDIUM] CWE-200 CVE-2018-5496: Data ONTAP operating in 7-Mode versions prior to 8.2.5P2 are susceptible to a vulnerability which di Data ONTAP operating in 7-Mode versions prior to 8.2.5P2 are susceptible to a vulnerability which discloses sensitive information to an unauthorized user.

CVE-2015-7746 [CRITICAL] CWE-287 CVE-2015-7746: NetApp Data ONTAP before 8.2.4, when operating in 7-Mode, allows remote attackers to bypass authenti NetApp Data ONTAP before 8.2.4, when operating in 7-Mode, allows remote attackers to bypass authentication and (1) obtain sensitive information from or (2) modify volumes via vectors related to UTF-8 in the volume language.

CVE-2016-1895 [MEDIUM] CWE-134 CVE-2016-1895: NetApp Data ONTAP before 8.2.5 and 8.3.x before 8.3.2P12 allow remote authenticated users to cause a NetApp Data ONTAP before 8.2.5 and 8.3.x before 8.3.2P12 allow remote authenticated users to cause a denial of service via vectors related to unsafe user input string handling.

CVE-2017-12859 [MEDIUM] CWE-20 CVE-2017-12859: NetApp Data ONTAP before 8.2.5, when operating in 7-Mode in NFS environments, allows remote attacker NetApp Data ONTAP before 8.2.5, when operating in 7-Mode in NFS environments, allows remote attackers to cause a denial of service via unspecified vectors.

CVE-2016-3400 [HIGH] CWE-254 CVE-2016-3400: NetApp Data ONTAP 8.1 and 8.2, when operating in 7-Mode, allows man-in-the-middle attackers to obtai NetApp Data ONTAP 8.1 and 8.2, when operating in 7-Mode, allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service via vectors related to the SMB protocol.

CVE-2016-5374 [HIGH] CWE-264 CVE-2016-5374: NetApp Data ONTAP 9.0 and 9.1 before 9.1P1 allows remote authenticated users that own SMB-hosted dat NetApp Data ONTAP 9.0 and 9.1 before 9.1P1 allows remote authenticated users that own SMB-hosted data to bypass intended sharing restrictions by leveraging improper handling of the owner_rights ACL entry.

CVE-2015-8322 [HIGH] CVE-2015-8322: NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbi NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbitrary code via unspecified vectors.

CVE-2016-6495 [MEDIUM] CWE-200 CVE-2016-6495: NetApp Data ONTAP before 8.2.4P5, when operating in 7-Mode, allows remote attackers to obtain inform NetApp Data ONTAP before 8.2.4P5, when operating in 7-Mode, allows remote attackers to obtain information about the volumes configured for HTTP access.

CVE-2015-7886 [LOW] CWE-200 CVE-2015-7886: NetApp Data ONTAP before 8.2.4P1, when 7-Mode and HTTP access are enabled, allows remote attackers t NetApp Data ONTAP before 8.2.4P1, when 7-Mode and HTTP access are enabled, allows remote attackers to obtain sensitive volume information via unspecified vectors.