rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-8552 Kubernetes API server denial of service
The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.
Problem types: cwe_id: CWE-789
description: CWE-789 Uncontrolled Memory Allocation
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Gus Lees (Amazon)
Published: 2020-03-27T14:25:15.000Z
CVE-2020-8553 Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names
The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: Kubernetes
product: ingress-nginx
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Alex Orange
Published: 2020-07-29T14:53:32.000Z
CVE-2020-8554 Kubernetes man in the middle using LoadBalancer or ExternalIPs
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
Problem types: cwe_id: CWE-283
description: CWE-283 Unverified Ownership
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Etienne Champetier (@champtar) of Anevia
Published: 2021-01-21T17:09:21.169Z
CVE-2020-8555 Kubernetes  kube-controller-manager SSRF
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Brice Augras from Groupe-Asten and Christophe Hauquiert from Nokia
Published: 2020-06-04T21:50:11.749Z
CVE-2020-8557 Kubernetes node disk Denial of Service by writing to container /etc/hosts
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Kebe Liu of DaoCloud
Published: 2020-07-23T16:59:38.580Z
CVE-2020-8558 Kubernetes node setting allows for neighboring hosts to bypass localhost boundary
The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.
Problem types: cwe_id: CWE-420
description: CWE-420 Unprotected Alternate Channel
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: János Kövér, Ericsson
lang: en
value: Additional impacts reported by Rory McCune, NCC Group and Yuval Avrahami and Ariel Zelivansky, Palo Alto Networks
Published: 2020-07-27T19:55:19.321Z
CVE-2020-8559 Privilege escalation from compromised node to cluster
The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Wouter ter Maat of Offensi
Published: 2020-07-22T13:47:08.684Z
CVE-2020-8561 Webhook redirect in kube-apiserver
A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.
Problem types: cwe_id: CWE-441
description: CWE-441 Unintended Proxy or Intermediary
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: QiQi Xu
Published: 2021-09-20T17:05:16.328Z
CVE-2020-8562 Bypass of Kubernetes API Server proxy TOCTOU
As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane.
Problem types: cwe_id: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.2
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Javier Provecho
Published: 2022-02-01T10:33:00.317Z
CVE-2020-8563 Secret leaks in logs for vSphere Provider kube-controller-manager
In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Kaizhe Huang (derek0405)
Published: 2020-12-07T22:00:25.689Z
CVE-2020-8564 Docker config secrets leaked when file is malformed and loglevel >= 4
In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Nikolaos Moraitis (Red Hat)
Published: 2020-12-07T22:00:22.445Z
CVE-2020-8565 Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9
In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Patrick Rhomberg (purelyapplied)
Published: 2020-12-07T22:00:19.374Z
CVE-2020-8566 Ceph RBD adminSecrets exposed in logs when loglevel >= 4
In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Kaizhe Huang (derek0405)
Published: 2020-12-07T22:00:16.139Z
CVE-2020-8567 Kubernetes Secrets Store CSI Driver plugin directory traversals
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
Problem types: cwe_id: CWE-24
description: CWE-24 Path Traversal: '../filedir'
Affected products: vendor: Kubernetes
product: Kubernetes Secrets Store CSI Driver
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Tommy Murphy of Google
Published: 2021-01-21T17:09:21.322Z
CVE-2020-8568 Kubernetes Secrets Store CSI Driver sync/rotate directory traversal
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.
Problem types: cwe_id: CWE-24
description: CWE-24 Path Traversal: '../filedir'
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Kubernetes
product: Kubernetes Secrets Store CSI Driver
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Tommy Murphy of Google
Published: 2021-01-21T17:09:21.450Z
CVE-2020-8569 Kubernetes CSI snapshot-controller DoS
Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes, is automatically restarted by Kubernetes, and processes the same VolumeSnapshot custom resource after the restart, entering an endless crashloop. Only the volume snapshot feature is affected by this vulnerability. When exploited, users can’t take snapshots of their volumes or delete the snapshots. All other Kubernetes functionality is not affected.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: Kubernetes
product: CSI Snapshotter
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Qin Ping
Published: 2021-01-21T17:09:21.567Z
CVE-2020-8570 Kubernetes Java client libraries unvalidated path traversal in Copy implementation
Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: Kubernetes
product: Kubernetes Java Client
Credits: lang: en
value: Discovered via CodeQL automated scanning on GitHub
Published: 2021-01-21T17:09:21.689Z
CVE-2020-8571 
StorageGRID (formerly StorageGRID Webscale) versions 10.0.0 through 11.3 prior to 11.2.0.8 and 11.3.0.4 are susceptible to a vulnerability which allows an unauthenticated remote attacker to cause a Denial of Service (DoS).
Problem types: description: Privilege Escalation
Affected products: vendor: NetApp
product: StorageGRID (formerly StorageGRID Webscale)
Published: 2020-03-13T15:10:08.000Z
CVE-2020-8572 
Element OS prior to version 12.0 and Element HealthTools prior to version 2020.04.01.04 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Sensitive Information Disclosure Vulnerability in Element OS and Element HealthTools
Published: 2020-05-21T14:23:00.000Z
CVE-2020-8573 
The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers (BMC) are shipped with a documented default account and password that should be changed during the initial node setup. During upgrades to Element 11.8 and 12.0 or the Compute Firmware Bundle 12.2.92 the BMC account password on the H610C, H615C and H610S platforms is reset to the default documented value which could allow remote attackers to cause a Denial of Service (DoS).
Problem types: description: Default Credential
Affected products: vendor: NetApp
product: NetApp HCI Baseboard Management Controller (BMC) HCI H610C, NetApp HCI Baseboard Management Controller (BMC) HCI H615C, NetApp HCI Baseboard Management Controller (BMC) HCI H610S
Published: 2020-06-29T14:00:38.000Z
CVE-2020-8574 
Active IQ Unified Manager for Linux versions prior to 9.6 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service enabled allowing unauthorized code execution to local users.
Problem types: description: Unauthorized Code Execution
Affected products: vendor: n/a
product: Active IQ Unified Manager for Linux 7.3 and above
Published: 2020-08-03T16:56:55.000Z
CVE-2020-8575 
Active IQ Unified Manager for VMware vSphere and Windows versions prior to 9.5 are susceptible to a vulnerability which allows administrative users to cause Denial of Service (DoS).
Problem types: description: Denial of Service (DoS)
Affected products: vendor: n/a
product: Active IQ Unified Manager for VMware vSphere and Windows 7.3 and above
Published: 2020-08-03T16:55:52.000Z
CVE-2020-8576 
Clustered Data ONTAP versions prior to 9.3P19, 9.5P14, 9.6P9 and 9.7 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data or disclosure of sensitive information.
Problem types: description: Sensitive Information Disclosure
Affected products: vendor: n/a
product: Clustered Data ONTAP
Published: 2020-09-02T19:15:35.000Z
CVE-2020-8577 
SANtricity OS Controller Software versions 11.50.1 and higher are susceptible to a vulnerability which could allow an attacker to discover sensitive information by intercepting its transmission within an https session.
Problem types: description: Sensitive Information Disclosure
Affected products: vendor: n/a
product: E-Series SANtricity OS Controller Software
Published: 2020-11-06T16:03:21.000Z
CVE-2020-8578 
Clustered Data ONTAP versions prior to 9.3P20 are susceptible to a vulnerability which could allow an attacker to discover node names via AutoSupport bundles even when the –remove-private-data parameter is set to true.
Problem types: description: Disclosure of sensitive information
Affected products: vendor: n/a
product: Clustered Data ONTAP
Published: 2021-02-08T21:38:38.000Z
CVE-2020-8579 
Clustered Data ONTAP versions 9.7 through 9.7P7 are susceptible to a vulnerability which allows an attacker with access to an intercluster LIF to cause a Denial of Service (DoS).
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: clustered Data ONTAP
Published: 2020-10-27T13:47:21.000Z
CVE-2020-8580 
SANtricity OS Controller Software versions 11.30 and higher are susceptible to a vulnerability which allows an unauthenticated attacker with access to the system to cause a Denial of Service (DoS).
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: E-Series SANtricity OS Controller Software
Published: 2020-11-06T15:58:43.000Z
CVE-2020-8581 
Clustered Data ONTAP versions prior to 9.3P20 and 9.5 are susceptible to a vulnerability which could allow an authenticated but unauthorized attacker to overwrite arbitrary data when VMware vStorage support is enabled.
Problem types: description: Unauthorized Modification
Affected products: vendor: n/a
product: Clustered Data ONTAP
Published: 2021-01-19T17:04:11.000Z
CVE-2020-8582 
Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an authenticated user to view sensitive information.
Problem types: description: Disclosure Of Sensitive Information
Affected products: vendor: n/a
product: NetApp SolidFire & HCI Storage Node (Element Software)
Published: 2020-11-13T15:16:24.000Z
CVE-2020-8583 
Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an attacker to discover sensitive information by intercepting its transmission within an https session.
Problem types: description: Disclosure Of Sensitive Information
Affected products: vendor: n/a
product: NetApp SolidFire & HCI Storage Node (Element Software) )
Published: 2020-11-13T15:14:36.000Z
CVE-2020-8584 
Element OS versions prior to 1.8P1 and 12.2 are susceptible to a vulnerability that could allow an unauthenticated remote attacker to perform arbitrary code execution.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: n/a
product: Element OS
Published: 2021-01-08T15:19:37.000Z
CVE-2020-8585 
OnCommand Unified Manager Core Package versions prior to 5.2.5 may disclose sensitive account information to unauthorized users via the use of PuTTY Link (plink).
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: OnCommand Unified Manager for 7-Mode (core package)
Published: 2021-01-28T21:00:20.000Z
CVE-2020-8587 
OnCommand System Manager 9.x versions prior to 9.3P20 and 9.4 prior to 9.4P3 are susceptible to a vulnerability that could allow HTTP clients to cache sensitive responses making them accessible to an attacker who has access to the system where the client runs.
Problem types: description: Disclosure of sensitive information
Affected products: vendor: n/a
product: OnCommand System Manager 9.x
Published: 2021-02-08T21:36:20.000Z
CVE-2020-8588 
Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to discover the existence of data on other Storage Virtual Machines (SVMs).
Problem types: description: Disclosure of sensitive information
Affected products: vendor: n/a
product: Clustered Data ONTAP
Published: 2021-02-03T17:33:11.000Z
CVE-2020-8589 
Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to discover the names of other Storage Virtual Machines (SVMs) and filenames on those SVMs.
Problem types: description: Disclosure of sensitive information
Affected products: vendor: n/a
product: Clustered Data ONTAP
Published: 2021-02-03T17:35:47.000Z
CVE-2020-8590 
Clustered Data ONTAP versions prior to 9.1P18 and 9.3P12 are susceptible to a vulnerability which could allow an attacker to discover node names via AutoSupport bundles even when the –remove-private-data parameter is set to true.
Problem types: description: Disclosure of sensitive information
Affected products: vendor: n/a
product: Clustered Data ONTAP
Published: 2021-02-08T21:40:43.000Z