# Netapp Oncommand Workflow Automation


- [CVE-2016-3427](https://insights.sbomify.com/CVE-2016-3427/): Oracle Java SE and JRockit Unspecified (critical 9.8, exploited in the wild)
- [CVE-2023-41993](https://insights.sbomify.com/CVE-2023-41993/): Apple Multiple Products WebKit Code Execution (high 8.8, exploited in the wild)
- [CVE-2018-11776](https://insights.sbomify.com/CVE-2018-11776/): Apache Struts Remote Code Execution (high 8.1, exploited in the wild)
- [CVE-2017-12617](https://insights.sbomify.com/CVE-2017-12617/): Apache Tomcat Remote Code Execution (high 8.1, exploited in the wild)
- [CVE-2015-3292](https://insights.sbomify.com/CVE-2015-3292/): Code injection in n/a (critical 10.0)
- [CVE-2022-37434](https://insights.sbomify.com/CVE-2022-37434/): Memory corruption in n/a (critical 9.8)
- [CVE-2022-1292](https://insights.sbomify.com/CVE-2022-1292/): The c_rehash script allows command injection (critical 9.8)
- [CVE-2022-23852](https://insights.sbomify.com/CVE-2022-23852/): Integer overflow in n/a (critical 9.8)
- [CVE-2021-3711](https://insights.sbomify.com/CVE-2021-3711/): SM2 Decryption Buffer Overflow (critical 9.8)
- [CVE-2021-22931](https://insights.sbomify.com/CVE-2021-22931/): Code injection in Node (critical 9.8)
- [CVE-2020-10683](https://insights.sbomify.com/CVE-2020-10683/): dom4j allows External Entities by default which might enable XXE attacks (critical 9.8)
- [CVE-2020-8840](https://insights.sbomify.com/CVE-2020-8840/): Deserialization of Untrusted Data in jackson-databind (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/netapp/oncommand-workflow-automation/