Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
78 results · page 2 of 2
Aug 30, 2023Brocade SANnav before v2.3.0 and v2.2.2a stores SNMPv3 Authentication passwords in plaintext.CVE-2023-31925 · Other software · Brocade · reported by sirt@brocade.comMedium 5.4
Brocade SANnav before v2.3.0 and v2.2.2a stores SNMPv3 Authentication passwords in plaintext. A privileged user could retrieve these credentials with knowledge and access to these log files. SNMP credentials could be seen in SANnav SupportSave if the capture is performed after an SNMP configuration failure causes an SNMP communication log dump.
- Product
- Brocade SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comsupport.broadcom.com
Aug 30, 2023Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization.CVE-2023-31424 · Other software · Brocade · reported by sirt@brocade.comHigh 8.1
Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization.
- Product
- SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsupport.broadcom.com
Dec 8, 2022Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs.CVE-2022-33187 · Other software · Brocade · reported by sirt@brocade.comMedium 5.5
Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information.
- Product
- Brocade SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Jun 27, 2022In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an CVE-2022-28168 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.5
In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an attacker able to access log files to easily decode the passwords.
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.combroadcom.com
Jun 27, 2022Brocade SANnav before Brocade SANvav v.CVE-2022-28167 · Other software · Broadcom · reported by sirt@brocade.comMedium 6.5
Brocade SANnav before Brocade SANvav v. 2.2.0.2 and Brocade SANanv v.2.1.1.8 logs the Brocade Fabric OS switch password in plain text in asyncjobscheduler-manager.log
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.combroadcom.com
Jun 27, 2022In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Supports the Use of Static Key Ciphers (sslCVE-2022-28166 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.5
In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Supports the Use of Static Key Ciphers (ssl-static-key-ciphers) on ports 443 & 18082.
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.combroadcom.com
May 9, 2022Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text.CVE-2022-28162 · Other software · Broadcom · reported by sirt@brocade.comLow 3.3
Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text.
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
May 9, 2022An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to viCVE-2022-28161 · Other software · Brocade · reported by sirt@brocade.comMedium 5.5
An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to view sensitive information such as ssh passwords in filetansfer.log in debug mode. To exploit this vulnerability, the attacker would need to have valid user credentials and turn on debug mode.
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
May 6, 2022A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an authenticated, remote attacker to accessCVE-2022-28165 · Other software · Broadcom · reported by sirt@brocade.comHigh 8.8
A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actions that they should not be able to perform. The vulnerability exists because restrictions are not performed on Server side to ensure the user has required permission before processing requests.
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
May 6, 2022Brocade SANnav before SANnav 2.2.0 application uses the Blowfish symmetric encryption algorithm for the storage of passwords.CVE-2022-28164 · Other software · Broadcom · reported by sirt@brocade.comMedium 6.5
Brocade SANnav before SANnav 2.2.0 application uses the Blowfish symmetric encryption algorithm for the storage of passwords. This could allow an authenticated attacker to decrypt stored account passwords.
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
May 6, 2022In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL injection, allowing an attacker to run CVE-2022-28163 · Other software · Broadcom · reported by sirt@brocade.comCritical 9.8
In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL injection, allowing an attacker to run arbitrary SQL commands.
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Jun 9, 2021The host SSH servers of Brocade Fabric OS before Brocade Fabric OS v7.4.2h, v8.2.1c, v8.2.2, v9.0.0, and Brocade SANnav before v2.1.1 utilize keys of less than CVE-2020-15387 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.4
The host SSH servers of Brocade Fabric OS before Brocade Fabric OS v7.4.2h, v8.2.1c, v8.2.2, v9.0.0, and Brocade SANnav before v2.1.1 utilize keys of less than 2048 bits, which may be vulnerable to man-in-the-middle attacks and/or insecure SSH communications.
- Product
- Brocade Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Jun 9, 2021Brocade SANnav before version 2.1.1 allows an authenticated attacker to list directories, and list files without permission.CVE-2020-15385 · Other software · Broadcom · reported by sirt@brocade.comMedium 5.4
Brocade SANnav before version 2.1.1 allows an authenticated attacker to list directories, and list files without permission. As a result, users without permission can see folders, and hidden files, and can create directories without permission.
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Jun 9, 2021Brocade SANNav before version 2.1.1 contains an information disclosure vulnerability.CVE-2020-15384 · Other software · Broadcom · reported by sirt@brocade.comMedium 5.3
Brocade SANNav before version 2.1.1 contains an information disclosure vulnerability. Successful exploitation of internal server information in the initial login response header.
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Jun 9, 2021Brocade SANnav before version 2.1.1 logs account credentials at the ‘trace’ logging level.CVE-2020-15380 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.5
Brocade SANnav before version 2.1.1 logs account credentials at the ‘trace’ logging level.
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Jun 9, 2021Brocade SANnav before v.2.1.0a could allow remote attackers cause a denial-of-service condition due to a lack of proper validation, of the length of user-suppliCVE-2020-15379 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.5
Brocade SANnav before v.2.1.0a could allow remote attackers cause a denial-of-service condition due to a lack of proper validation, of the length of user-supplied data as name for custom field name.
- Product
- Brocade Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Jun 9, 2021The OVA version of Brocade SANnav before version 2.1.1 installation with IPv6 networking exposes the docker container ports to the network, increasing the potenCVE-2020-15378 · Other software · Broadcom · reported by sirt@brocade.comMedium 5.3
The OVA version of Brocade SANnav before version 2.1.1 installation with IPv6 networking exposes the docker container ports to the network, increasing the potential attack surface.
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Jun 9, 2021Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to a misconfiguration; this is commonly refCVE-2020-15377 · Other software · Broadcom · reported by sirt@brocade.comCritical 9.8
Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to a misconfiguration; this is commonly referred to as Server-Side Request Forgery (SSRF).
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Jun 9, 2021Brocade SANnav before version 2.1.1 uses a hard-coded administrator account with the weak password ‘passw0rd’ if a password is not provided for PostgreSQL at inCVE-2020-15382 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.2
Brocade SANnav before version 2.1.1 uses a hard-coded administrator account with the weak password ‘passw0rd’ if a password is not provided for PostgreSQL at install-time.
- Product
- Brocade Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Jun 9, 2021Brocade SANnav before version 2.1.1 contains an Improper Authentication vulnerability that allows cleartext transmission of authentication credentials of the jmCVE-2020-15381 · Other software · Broadcom · reported by sirt@brocade.comHigh 7.5
Brocade SANnav before version 2.1.1 contains an Improper Authentication vulnerability that allows cleartext transmission of authentication credentials of the jmx server.
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Sep 25, 2020A vulnerability in Brocade SANnav versions before v2.1.0 could allow a remote authenticated attacker to conduct an LDAP injection.CVE-2019-16212 · Other software · Broadcom · reported by sirt@brocade.comHigh 8.8
A vulnerability in Brocade SANnav versions before v2.1.0 could allow a remote authenticated attacker to conduct an LDAP injection. The vulnerability could allow a remote attacker to bypass the authentication process.
- Product
- Brocade Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Sep 25, 2020Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability.CVE-2019-16211 · Other software · Broadcom · reported by sirt@brocade.comCritical 9.8
Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability.
- Product
- Brocade Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Nov 8, 2019Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save.CVE-2019-16210 · Other software · Brocade Communications Systems, Inc. · reported by sirt@brocade.comMedium 5.5
Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save.
- Product
- Brocade SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Nov 8, 2019A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to perform a man-in-the-middle attack against CVE-2019-16209 · Other software · Brocade Communications Systems, Inc. · reported by sirt@brocade.comHigh 7.4
A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to perform a man-in-the-middle attack against Secure Sockets Layer(SSL)connections.
- Product
- Brocade SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Nov 8, 2019Password-based encryption (PBE) algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptographic keys that may allow an attacker toCVE-2019-16208 · Other software · Brocade Communications Systems, Inc. · reported by sirt@brocade.comHigh 7.5
Password-based encryption (PBE) algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptographic keys that may allow an attacker to decrypt passwords used with several services (Radius, TACAS, etc.).
- Product
- Brocade SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Nov 8, 2019Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database and gain privilegesCVE-2019-16207 · Other software · Brocade Communications Systems, Inc. · reported by sirt@brocade.comHigh 7.8
Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database and gain privileges.
- Product
- Brocade SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Nov 8, 2019The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' logging level; which couCVE-2019-16206 · Other software · Brocade Communications Systems, Inc. · reported by sirt@brocade.comMedium 5.5
The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' logging level; which could allow a local authenticated attacker to access sensitive information.
- Product
- Brocade SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Nov 8, 2019A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID.CVE-2019-16205 · Other software · Brocade Communications Systems, Inc. · reported by sirt@brocade.comHigh 8.8
A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insufficiently random session ID for several post-authentication actions in the SANnav portal.
- Product
- Brocade SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.