Updated 34 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

353new WordPress flaws this week

390,080entries in the database

127 results · page 2 of 3

Feb 14, 2025If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsecret fields can be exCVE-2024-5462 · Other software · Brocade · reported by sirt@brocade.comMedium 5.3
If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsecret fields can be exposed in plaintext. The plaintext passwords can be exposed in a configupload capture or a supportsave capture if encryption of passwords is not enabled. An attacker can use these passwords to fetch values of the supported OIDs via SNMPv3 queries. There are also a limited number of MIB objects that can be modified.
Product
Brocade Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com
Feb 14, 2025Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes internal script calls to sCVE-2024-5461 · Other software · Brocade · reported by sirt@brocade.comHigh 8.6
Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes internal script calls to system.sh from within the SNMP binary. An authenticated attacker could perform command or parameter injection on SNMP operations that are only enabled on the Brocade 6547 (FC5022) embedded switch. This injection could allow the authenticated attacker to issue commands as Root.
Product
Brocade Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com
Nov 21, 2024A command injection vulnerability in Brocade Fabric OS before 9.2.0c, and 9.2.1 through 9.2.1a on IP extension platforms could allow a local authenticated attacCVE-2024-7517 · Other software · Brocade · reported by sirt@brocade.comHigh 8.5
A command injection vulnerability in Brocade Fabric OS before 9.2.0c, and 9.2.1 through 9.2.1a on IP extension platforms could allow a local authenticated attacker to perform a privileged escalation via crafted use of the portcfg command. This specific exploitation is only possible on IP Extension platforms: Brocade 7810, Brocade 7840, Brocade 7850 and on Brocade X6 or X7 directors with an SX-6 Extension blade installed. The attacker must be logged into the switch via SSH or serial console to conduct the attack.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com
Nov 21, 2024Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmwarCVE-2024-10403 · Other software · Brocade · reported by sirt@brocade.comMedium 5.9
Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmware download operation initiated by SANnav or through WebEM in a weblinker core dump that is later captured via supportsave.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com
Nov 21, 2024Brocade SANnav versions before 2.2.2 log Brocade Fabric OS switch passwords when debugging is enabled.CVE-2022-43936 · Other software · Brocade · reported by sirt@brocade.comMedium 6.8
Brocade SANnav versions before 2.2.2 log Brocade Fabric OS switch passwords when debugging is enabled.
Product
SANnav
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com
Nov 21, 2024An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where Brocade Fabric OS Switch passwords and authorCVE-2022-43935 · Other software · Brocade · reported by sirt@brocade.comMedium 5.3
An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where Brocade Fabric OS Switch passwords and authorization IDs are printed in the embedded MLS DB file.
Product
SANnav
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com
Nov 12, 2024A vulnerability in Brocade Fabric OS versions before 9.2.2 could allow man-in-the-middle attackers to conduct remote Service Session Hijacking that may arise frCVE-2024-7516 · Other software · Brocade · reported by sirt@brocade.comHigh 7
A vulnerability in Brocade Fabric OS versions before 9.2.2 could allow man-in-the-middle attackers to conduct remote Service Session Hijacking that may arise from the attacker's ability to forge an SSH key while the Brocade Fabric OS Switch is performing various remote operations initiated by a switch admin.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com
Jun 25, 2024A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before v9.0.0 could allow CVE-2024-5460 · Other software · Brocade · reported by sirt@brocade.comHigh 8.1
A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before v9.0.0 could allow an authenticated, remote attacker to read data from an affected device via SNMP. The vulnerability is due to hard-coded, default community string in the configuration file for the SNMP daemon. An attacker could exploit this vulnerability by using the static community string in SNMP version 1 queries to an affected device.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com support.broadcom.com
Jun 25, 2024A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log fileCVE-2024-29954 · Other software · Brocade · reported by sirt@brocade.comMedium 5.9
A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for protocols such as scp and sftp. Detail. When the firmwaredownload command is incorrectly entered or points to an erroneous file, the firmware download log captures the failed command, including any password entered in the command line.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com security.netapp.com
Jun 25, 2024A vulnerability in the web interface in Brocade Fabric OS before v9.2.1, v9.2.0b, and v9.1.1d prints encoded session passwords on session storage for Virtual FaCVE-2024-29953 · Other software · Brocade · reported by sirt@brocade.comMedium 4.3
A vulnerability in the web interface in Brocade Fabric OS before v9.2.1, v9.2.0b, and v9.1.1d prints encoded session passwords on session storage for Virtual Fabric platforms. This could allow an authenticated user to view other users' session encoded passwords.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com security.netapp.com
Apr 19, 2024A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support savCVE-2024-29959 · Other software · Brocade · reported by sirt@brocade.comHigh 8.6
A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support save.
Product
Brocade SANnav
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com support.broadcom.com
Apr 4, 2024Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved charCVE-2023-5973 · Other software · Brocade · reported by sirt@brocade.comMedium 4.3
Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports display.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Apr 4, 2024Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to gaCVE-2023-3454 · Other software · Brocade · reported by sirt@brocade.comHigh 8.6
Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to gain root access to the Brocade switch.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Dec 5, 2023Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, which supports the license string format; contain cryptographic CVE-2021-27795 · Other software · Brocade · reported by sirt@brocade.comMedium 6.4
Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, which supports the license string format; contain cryptographic issues that could allow for the installation of forged or fraudulent license keys. This would allow attackers or a malicious party to forge a counterfeit license key that the Brocade Fabric OS platform would authenticate and activate as if it were a legitimate license key.
Product
Brocade Switches
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com support.broadcom.com
Aug 30, 2023In Brocade Fabric OS before v9.2.0a, a local authenticated privileged user can trigger a buffer overflow condition, leading to a kernel panic with large inpuCVE-2023-4163 · Other software · Brocade · reported by sirt@brocade.comMedium 4.4
In Brocade Fabric OS before v9.2.0a, a local authenticated privileged user can trigger a buffer overflow condition, leading to a kernel panic with large input to buffers in the portcfgfportbuffers command.
Product
Brocade Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 30, 2023A segmentation fault can occur in Brocade Fabric OS after Brocade Fabric OS v9.0 and before Brocade Fabric OS v9.2.0a through the passwdcfg command.CVE-2023-4162 · Other software · Brocade · reported by sirt@brocade.comMedium 4.4
A segmentation fault can occur in Brocade Fabric OS after Brocade Fabric OS v9.0 and before Brocade Fabric OS v9.2.0a through the passwdcfg command. This could allow an authenticated privileged user local user to crash a Brocade Fabric OS swith using the cli “passwdcfg --set -expire -minDiff“.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 30, 2023The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a dCVE-2023-3489 · Other software · Brocade · reported by sirt@brocade.comHigh 8.6
The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade from Fabric OS v9.2.0 to any earlier version of Fabric OS.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated aCVE-2023-31927 · Other software · Brocade · reported by sirt@brocade.comMedium 5.3
An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated attacker to get technical details about the web interface.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0.CVE-2023-31926 · Other software · Brocade · reported by sirt@brocade.comHigh 7.1
System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023A reflected cross-site scripting (XSS) vulnerability exists in Brocade Webtools PortSetting.html of Brocade Fabric OS version before Brocade Fabric OS v9.2.0 tCVE-2023-31928 · Other software · Brocade · reported by sirt@brocade.comMedium 6.3
A reflected cross-site scripting (XSS) vulnerability exists in Brocade Webtools PortSetting.html of Brocade Fabric OS version before Brocade Fabric OS v9.2.0 that could allow a remote unauthenticated attacker to execute arbitrary JavaScript code in a target user’s session with the Brocade Webtools application.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c could allow an authenticated user to crashCVE-2023-31431 · Other software · Brocade · reported by sirt@brocade.comMedium 5.5
A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c could allow an authenticated user to crash the Brocade Fabric OS switch leading to a denial of service.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0 could allow an authenticated priviCVE-2023-31430 · Other software · Brocade · reported by sirt@brocade.comMedium 5.5
A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0 could allow an authenticated privileged user to crash the Brocade Fabric OS switch leading to a denial of service.
Product
Brocade Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dump files under user'sCVE-2023-31428 · Other software · Brocade · reported by sirt@brocade.comMedium 5.5
Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dump files under user's home directory using grep.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside BrocadCVE-2023-31427 · Other software · Brocade · reported by sirt@brocade.comHigh 7.8
Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Brocade Fabric OS to execute any command regardless of assigned privilege. Starting with Fabric OS v9.1.0, “root” account access is disabled.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023 The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0 print scp, sftp, ftp servers passwords iCVE-2023-31426 · Other software · Brocade · reported by sirt@brocade.comMedium 6.8
The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0 print scp, sftp, ftp servers passwords in supportsave. This could allow a remote authenticated attacker to access sensitive information.
Product
Brocade Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”, eCVE-2023-31429 · Other software · Brocade · reported by sirt@brocade.comMedium 5.5
Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”, errmoduleshow, errfilterset, hassiscfgperrthreshold, supportshowcfgdisable and supportshowcfgenable commands that can cause the content of shell interpreted variables to be printed in the terminal.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023A vulnerability in the fosexec command of Brocade Fabric OS after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS v9.1.1 could allow a local authenticateCVE-2023-31425 · Other software · Brocade · reported by sirt@brocade.comHigh 7.8
A vulnerability in the fosexec command of Brocade Fabric OS after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS v9.1.1 could allow a local authenticated user to perform privilege escalation to root by breaking the rbash shell. Starting with Fabric OS v9.1.0, “root” account access is disabled.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Dec 8, 2022A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute oCVE-2022-33186 · Other software · Broadcom · reported by sirt@brocade.comCritical 9.8
A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands capable of modifying zoning, disabling the switch, disabling ports, and modifying the switch IP address.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Oct 25, 2022Several commands in Brocade Fabric OS before Brocade Fabric OS v.9.0.1e, and v9.1.0 use unsafe string functions to process user input.CVE-2022-33185 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.8
Several commands in Brocade Fabric OS before Brocade Fabric OS v.9.0.1e, and v9.1.0 use unsafe string functions to process user input. Authenticated local attackers could abuse these vulnerabilities to exploit stack-based buffer overflows, allowing arbitrary code execution as the root user account.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Oct 25, 2022A vulnerability in fab_seg.c.h libraries of all Brocade Fabric OS versions before Brocade Fabric OS v9.1.1, v9.0.1e, v8.2.3c, v8.2.0_cbn5, 7.4.2j could allow loCVE-2022-33184 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.8
A vulnerability in fab_seg.c.h libraries of all Brocade Fabric OS versions before Brocade Fabric OS v9.1.1, v9.0.1e, v8.2.3c, v8.2.0_cbn5, 7.4.2j could allow local authenticated attackers to exploit stack-based buffer overflows and execute arbitrary code as the root user account.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Oct 25, 2022A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a remote authenticated attacker to perfCVE-2022-33183 · Other software · Broadcom · reported by sirt@brocade.comHigh 8.8
A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a remote authenticated attacker to perform stack buffer overflow using in “firmwaredownload” and “diagshow” commands.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Oct 25, 2022A privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, could allow a local authenticated userCVE-2022-33182 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.8
A privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, could allow a local authenticated user to escalate its privilege to root using switch commands “supportlink”, “firmwaredownload”, “portcfgupload, license, and “fosexec”.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Oct 25, 2022An information disclosure vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a local authentCVE-2022-33181 · Other software · Broadcom · reported by sirt@brocade.comMedium 5.5
An information disclosure vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a local authenticated attacker to read sensitive files using switch commands “configshow” and “supportlink”.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Oct 25, 2022A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5 could allow a local authenticated attacker to export out senCVE-2022-33180 · Other software · Broadcom · reported by sirt@brocade.comMedium 5.5
A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5 could allow a local authenticated attacker to export out sensitive files with “seccryptocfg”, “configupload”.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Oct 25, 2022A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, and 7.4.2j could allow a local authenticated user to break out of restCVE-2022-33179 · Other software · Broadcom · reported by sirt@brocade.comHigh 8.8
A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, and 7.4.2j could allow a local authenticated user to break out of restricted shells with “set context” and escalate privileges.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Oct 25, 2022A vulnerability in the radius authentication system of Brocade Fabric OS before Brocade Fabric OS 9.0 could allow a remote attacker to execute arbitrary code onCVE-2022-33178 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.2
A vulnerability in the radius authentication system of Brocade Fabric OS before Brocade Fabric OS 9.0 could allow a remote attacker to execute arbitrary code on the Brocade switch.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Oct 25, 2022Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the debug statements.CVE-2022-28170 · Other software · Broadcom · reported by sirt@brocade.comMedium 6.5
Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the debug statements. This could allow a local user to extract the passwords from a debug file.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Oct 25, 2022Brocade Webtools in Brocade Fabric OS versions before Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c could allow a low privilege webtools, user, to gaiCVE-2022-28169 · Other software · Broadcom · reported by sirt@brocade.comHigh 8.8
Brocade Webtools in Brocade Fabric OS versions before Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c could allow a low privilege webtools, user, to gain elevated admin rights, or privileges, beyond what is intended or entitled for that user. By exploiting this vulnerability, a user whose role is not an admin can create a new user with an admin role using the operator session id. The issue was replicated after intercepting the admin, and operator authorization headers sent unencrypted and editing a user addition request to use the operator's authorization header.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Aug 5, 2022A vulnerability in Brocade Fabric OS versions 7.4.1b and 7.3.1d could allow local users to conduct privileged directory transversal.CVE-2021-27798 · Other software · Brocade · reported by sirt@brocade.comMedium 5.5
A vulnerability in Brocade Fabric OS versions 7.4.1b and 7.3.1d could allow local users to conduct privileged directory transversal. Brocade Fabric OS versions 7.4.1.x and 7.3.x have reached end of life. Brocade Fabric OS Users should upgrade to supported versions as described in the Product End-of-Life published report.
Product
Brocade Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Mar 18, 2022The Web application of Brocade Fabric OS before versions Brocade Fabric OS v9.0.1a and v8.2.3a contains debug statements that expose sensitive information to thCVE-2021-27789 · Other software · Broadcom · reported by sirt@brocade.comMedium 6.5
The Web application of Brocade Fabric OS before versions Brocade Fabric OS v9.0.1a and v8.2.3a contains debug statements that expose sensitive information to the program's standard output device. An attacker who has compromised the FOS system may utilize this weakness to capture sensitive information, such as user credentials.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Mar 18, 2022A vulnerability in the Brocade Fabric OS before Brocade Fabric OS v9.0.1a, v8.2.3, v8.2.0_CBN4, and v7.4.2h could allow an authenticated CLI user to abuse the hCVE-2020-15388 · Other software · Broadcom · reported by sirt@brocade.comMedium 6.5
A vulnerability in the Brocade Fabric OS before Brocade Fabric OS v9.0.1a, v8.2.3, v8.2.0_CBN4, and v7.4.2h could allow an authenticated CLI user to abuse the history command to write arbitrary content to files.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Feb 21, 2022Brocade Fabric OS before Brocade Fabric OS v8.2.1c, v8.1.2h, and all versions of Brocade Fabric OS v8.0.x and v7.x contain documented hard-coded credentials, whCVE-2021-27797 · Other software · Broadcom · reported by sirt@brocade.comCritical 9.8
Brocade Fabric OS before Brocade Fabric OS v8.2.1c, v8.1.2h, and all versions of Brocade Fabric OS v8.0.x and v7.x contain documented hard-coded credentials, which could allow attackers to gain access to the system.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Feb 21, 2022A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell enviroCVE-2021-27796 · Other software · Broadcom · reported by sirt@brocade.comMedium 6.5
A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell environment (rbash) as either the “user” or “factory” account, to read the contents of any file on the filesystem utilizing one of a few available binaries.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 12, 2021A vulnerability in the authentication mechanism of Brocade Fabric OS versions before Brocade Fabric OS v.9.0.1a, v8.2.3a and v7.4.2h could allow a user to LoginCVE-2021-27794 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.8
A vulnerability in the authentication mechanism of Brocade Fabric OS versions before Brocade Fabric OS v.9.0.1a, v8.2.3a and v7.4.2h could allow a user to Login with empty password, and invalid password through telnet, ssh and REST.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Aug 12, 2021ntermittent authorization failure in aaa tacacs+ with Brocade Fabric OS versions before Brocade Fabric OS v9.0.1b and after 9.0.0, also in Brocade Fabric OS befCVE-2021-27793 · Other software · Broadcom · reported by sirt@brocade.comMedium 5.3
ntermittent authorization failure in aaa tacacs+ with Brocade Fabric OS versions before Brocade Fabric OS v9.0.1b and after 9.0.0, also in Brocade Fabric OS before Brocade Fabric OS v8.2.3a and after v8.2.0 could cause a user with a valid account to be unable to log into the switch.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Aug 12, 2021The request handling functions in web management interface of Brocade Fabric OS versions before v9.0.1a, v8.2.3a, and v7.4.2h do not properly handle malformed uCVE-2021-27792 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.8
The request handling functions in web management interface of Brocade Fabric OS versions before v9.0.1a, v8.2.3a, and v7.4.2h do not properly handle malformed user input, resulting in a service crash. An authenticated attacker could use this weakness to cause the FOS HTTP application handler to crash, requiring a reboot.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Aug 12, 2021The function that is used to parse the Authentication header in Brocade Fabric OS Web application service before Brocade Fabric OS v9.0.1a and v8.2.3a fails to CVE-2021-27791 · Other software · Broadcom · reported by sirt@brocade.comMedium 5.4
The function that is used to parse the Authentication header in Brocade Fabric OS Web application service before Brocade Fabric OS v9.0.1a and v8.2.3a fails to properly process a malformed authentication header from the client, resulting in reading memory addresses outside the intended range. An unauthenticated attacker could discover a request, which could bypass the authentication process.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Aug 12, 2021The command ipfilter in Brocade Fabric OS before Brocade Fabric OS v.9.0.1a, v8.2.3, and v8.2.0_CBN4, and v7.4.2h uses unsafe string function to process user inCVE-2021-27790 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.8
The command ipfilter in Brocade Fabric OS before Brocade Fabric OS v.9.0.1a, v8.2.3, and v8.2.0_CBN4, and v7.4.2h uses unsafe string function to process user input. Authenticated attackers can abuse this vulnerability to exploit stack-based buffer overflows, allowing execution of arbitrary code as the root user account.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com
Jun 9, 2021The host SSH servers of Brocade Fabric OS before Brocade Fabric OS v7.4.2h, v8.2.1c, v8.2.2, v9.0.0, and Brocade SANnav before v2.1.1 utilize keys of less than CVE-2020-15387 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.4
The host SSH servers of Brocade Fabric OS before Brocade Fabric OS v7.4.2h, v8.2.1c, v8.2.2, v9.0.0, and Brocade SANnav before v2.1.1 utilize keys of less than 2048 bits, which may be vulnerable to man-in-the-middle attacks and/or insecure SSH communications.
Product
Brocade Sannav
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Jun 9, 2021Brocade Fabric OS prior to v9.0.1a and 8.2.3a and after v9.0.0 and 8.2.2d may observe high CPU load during security scanning, which could lead to a slower respoCVE-2020-15386 · Other software · Broadcom · reported by sirt@brocade.comMedium 5.3
Brocade Fabric OS prior to v9.0.1a and 8.2.3a and after v9.0.0 and 8.2.2d may observe high CPU load during security scanning, which could lead to a slower response to CLI commands and other operations.
Product
Fabric Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com broadcom.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.