Most severe vulnerabilities for "netapp oncommand unified manager" 7.3

Where

AND

Sort:

maven/org.apache.tomcat.embed:tomcat-embed-coreLast updated 18 August 2025

Risk 90

Severity

9.8

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Tomcat through versions 7.0.88, 8.0.52, 8.5.31 and 9.0.8 have defaults settings for the CORS filter that are insecure and enable 'supportsCredentials' for all origins.

Upstream announcement:

https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1@%3Cannounce.tomcat.apache.org%3E

Upstream bug:

https://bz.apache.org/bugzilla/showbug.cgi?id=62343

Upstream Patches:

http://svn.apache.org/viewvc?view=rev&rev=1831726 / trunk/9.0 http://svn.apache.org/viewvc?view=rev&rev=1831728 / 8.5 http://svn.apache.org/viewvc?view=rev&rev=1831729 / 8.0 http://svn.apache.org/viewvc?view=rev&rev=1831730 / 7.0

External References:

http://tomcat.apache.org/security-9.html#FixedinApacheTomcat9.0.9 http://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.5.32 http://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.0.53 http://tomcat.apache.org/security-7.html#FixedinApacheTomcat7.0.89

1 / 3

Source: Red Hat

First published (updated )

CVE-2018-8014

NetApp OnCommand Unified ManagerInput Validation

Risk 86

Severity

9.8

Input Validation

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.

First published (updated )

CVE-2018-5487

debian/openjdk-10Last updated 25 August 2025

Risk 73

Severity

8.3

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Last updated 25 August 2025

1 / 2

Source: Ubuntu

First published (updated )

CVE-2018-2826

debian/openjdk-10Last updated 25 August 2025

Risk 73

Severity

8.3

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Last updated 25 August 2025

1 / 2

Source: Ubuntu

First published (updated )

CVE-2018-2825

NetApp OnCommand Unified ManagerNetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Pro…

Risk 69

Severity

7.8

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauthorized local attackers to execute arbitrary code.

First published (updated )

CVE-2018-5486

NetApp OnCommand Unified ManagerNetApp OnCommand Unified Manager for Windows versions 7.2 through 7.3 are susceptible to a vulnerabi…

Risk 69

Severity

7.8

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NetApp OnCommand Unified Manager for Windows versions 7.2 through 7.3 are susceptible to a vulnerability which could lead to a privilege escalation attack.

First published (updated )

CVE-2018-5485