Vasa Provider
Vendor:
First CVE: Aug 8, 2017 · Active for 8 years
11
Total CVEs
More Total CVEs than 89% of tracked products
3.7
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
7.1
Avg CVSS
Higher Avg CVSS than 43% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Vasa Provider over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 8, 2017
8 years ago
Most Recent CVE
Oct 23, 2020
2,099 days ago
CVE Severity & Scoring
Vasa Provider11 CVEs
36%
55%
9%
All CVEs352,101 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local4 (36.4%)
Network7 (63.6%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low7 (63.6%)
High4 (36.4%)
Unknown0 (0.0%)
User Interaction
None6 (54.5%)
Unknown0 (0.0%)
Required5 (45.5%)
Privileges Required
Low1 (9.1%)
High0 (0.0%)
None10 (90.9%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-15473MEDIUM OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has be | Aug 17, 2018 | 5.3 | 86 | NO | YES |
CVE-2018-6485CRITICAL An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to retu | Feb 1, 2018 | 9.8 | 33 | NO | NO |
CVE-2016-10708HIGH sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated | Jan 21, 2018 | 7.5 | 31 | NO | NO |
CVE-2018-2826HIGH Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). The supported version that is affected is Java SE: 10. Difficult to exploit vulnerability allows | Apr 19, 2018 | 8.3 | 28 | NO | NO |
CVE-2018-2825HIGH Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). The supported version that is affected is Java SE: 10. Difficult to exploit vulnerability allows | Apr 19, 2018 | 8.3 | 26 | NO | NO |
CVE-2016-6904HIGH Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. This could allow an unauthenticated attacker to obtai | Dec 11, 2017 | 8.1 | 26 | NO | NO |
CVE-2020-27216HIGH In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory i | Oct 23, 2020 | 7.0 | 25 | NO | NO |
CVE-2018-19931HIGH An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_sw | Dec 7, 2018 | 7.8 | 25 | NO | NO |
CVE-2018-20002MEDIUM The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted | Dec 10, 2018 | 5.5 | 21 | NO | NO |
CVE-2018-19932MEDIUM An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused | Dec 7, 2018 | 5.5 | 20 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (11 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
1 CVE
9.1% of CVEs· 97th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
9.1% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (11 CVEs).
Media Mentions
Signals from CVEs in this product scope (11 CVEs).
Top CNAs Publishing CVEs For Vasa Provider
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 6.x | 1 | 9.8 | 4.7% | 0 | 0 |
| 6.0 | 1 | 5.3 | 3.5% | 0 | 0 |