Broadcom
Page 3 of 4 — Broadcom CVEs from a corpus of 347, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-4324 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers |
CVE-2023-4323 | Critical | 9.8 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setup |
CVE-2023-4345 | Medium | 6.5 | 2023-08-15 | Broadcom RAID Controller web interface is vulnerable client-side control bypass leads to unauthorized data access for low privileged user |
CVE-2023-31927 | Medium | 5.3 | 2023-08-02 | An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated… |
CVE-2023-31926 | High | 7.1 | 2023-08-02 | System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0. |
CVE-2023-31928 | Medium | 6.3 | 2023-08-02 | A reflected cross-site scripting (XSS) vulnerability exists in Brocade Webtools PortSetting.html of Brocade Fabric OS version before Brocade Fabric OS v9.2.0… |
CVE-2023-31432 | High | 7.8 | 2023-08-02 | Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain roo… |
CVE-2023-31431 | Medium | 5.5 | 2023-08-02 | A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c could allow an authenticated user to cras… |
CVE-2023-31430 | Medium | 5.5 | 2023-08-02 | A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0 could allow an authenticated priv… |
CVE-2023-31428 | Medium | 5.5 | 2023-08-02 | Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dump files under user'… |
CVE-2023-31427 | High | 7.8 | 2023-08-01 | Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Broca… |
CVE-2023-31426 | Medium | 6.8 | 2023-08-01 | The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0 print scp, sftp, ftp servers passwords… |
CVE-2023-31429 | Medium | 5.5 | 2023-08-01 | Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”… |
CVE-2023-31425 | High | 7.8 | 2023-08-01 | A vulnerability in the fosexec command of Brocade Fabric OS after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS v9.1.1 could allow a local authenticat… |
CVE-2023-23955 | High | 8.1 | 2023-06-01 | Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Server-Side Request Forgery vulnerability. |
CVE-2023-23954 | Medium | 5.4 | 2023-06-01 | Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Stored Cross-Site Scripting vulnerability. |
CVE-2023-23953 | High | 7.8 | 2023-06-01 | Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to an Elevation of Privilege vulnerability. |
CVE-2023-23952 | Critical | 9.8 | 2023-06-01 | Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vulnerability. |
CVE-2023-23956 | Medium | 5.4 | 2023-05-30 | A user can supply malicious HTML and JavaScript code that will be executed in the client browser |
CVE-2023-20868 | Medium | 6.1 | 2023-05-26 | NSX-T contains a reflected cross-site scripting vulnerability due to a lack of input validation. A remote attacker can inject HTML or JavaScript to redirect to… |
CVE-2023-27538 | Medium | 5.5 | 2023-03-30 | An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH o… |
CVE-2023-27537 | Medium | 5.9 | 2023-03-30 | A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for… |
CVE-2023-27534 | High | 8.8 | 2023-03-30 | A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the fir… |
CVE-2023-27789 | High | 7.5 | 2023-03-16 | An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the cidr2cidr function at the cidr.c:178 endpoint. |
CVE-2023-27788 | High | 7.5 | 2023-03-16 | An issue found in TCPrewrite v.4.4.3 allows a remote attacker to cause a denial of service via the ports2PORT function at the portmap.c:69 endpoint. |
CVE-2023-27787 | High | 7.5 | 2023-03-16 | An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the parse_list function at the list.c:81 endpoint. |
CVE-2023-27786 | High | 7.5 | 2023-03-16 | An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the macinstring function. |
CVE-2023-27785 | High | 7.5 | 2023-03-16 | An issue found in TCPreplay TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the parse endpoints function. |
CVE-2023-27784 | High | 7.5 | 2023-03-16 | An issue found in TCPReplay v.4.4.3 allows a remote attacker to cause a denial of service via the read_hexstring function at the utils.c:309 endpoint. |
CVE-2023-27783 | High | 7.5 | 2023-03-16 | An issue found in TCPreplay tcprewrite v.4.4.3 allows a remote attacker to cause a denial of service via the tcpedit_dlt_cleanup function at plugins/dlt_plugin… |
CVE-2023-23951 | Medium | 6.1 | 2023-01-26 | Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application |
CVE-2023-23950 | Medium | 6.1 | 2023-01-26 | User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses. |
CVE-2023-23949 | Medium | 5.4 | 2023-01-26 | An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser. |
CVE-2022-25631 | High | 7.8 | 2023-01-20 | Symantec Endpoint Protection, prior to 14.3 RU6 (14.3.9210.6000), may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereb… |
CVE-2022-25628 | High | 8.8 | 2022-12-16 | An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4 |
CVE-2022-25627 | Medium | 6.7 | 2022-12-16 | An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Man… |
CVE-2022-25626 | Medium | 5.3 | 2022-12-16 | An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server sid… |
CVE-2022-33187 | Medium | 5.5 | 2022-12-09 | Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to re… |
CVE-2022-33186 | Critical | 9.8 | 2022-12-08 | A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute… |
CVE-2022-3643 | Medium | 6.5 | 2022-12-07 | Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network… |
CVE-2022-37017 | High | 7.5 | 2022-12-01 | Symantec Endpoint Protection (Windows) agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Control Bypass vulnerability, which is a typ… |
CVE-2022-37016 | Critical | 9.8 | 2022-12-01 | Symantec Endpoint Protection (Windows) agent may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attem… |
CVE-2022-33185 | High | 7.8 | 2022-10-25 | Several commands in Brocade Fabric OS before Brocade Fabric OS v.9.0.1e, and v9.1.0 use unsafe string functions to process user input. Authenticated local atta… |
CVE-2022-33184 | High | 7.8 | 2022-10-25 | A vulnerability in fab_seg.c.h libraries of all Brocade Fabric OS versions before Brocade Fabric OS v9.1.1, v9.0.1e, v8.2.3c, v8.2.0_cbn5, 7.4.2j could allow l… |
CVE-2022-33183 | High | 8.8 | 2022-10-25 | A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a remote authenticated attacker to per… |
CVE-2022-33182 | High | 7.8 | 2022-10-25 | A privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, could allow a local authenticated use… |
CVE-2022-33181 | Medium | 5.5 | 2022-10-25 | An information disclosure vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a local authen… |
CVE-2022-33180 | Medium | 5.5 | 2022-10-25 | A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5 could allow a local authenticated attacker to export out se… |
CVE-2022-33179 | High | 8.8 | 2022-10-25 | A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, and 7.4.2j could allow a local authenticated user to break out of res… |
CVE-2022-33178 | High | 7.2 | 2022-10-25 | A vulnerability in the radius authentication system of Brocade Fabric OS before Brocade Fabric OS 9.0 could allow a remote attacker to execute arbitrary code o… |
CVE-2022-28170 | Medium | 6.5 | 2022-10-25 | Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the debug statements. Thi… |
CVE-2022-28169 | High | 8.8 | 2022-10-25 | Brocade Webtools in Brocade Fabric OS versions before Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c could allow a low privilege webtools, user, to ga… |
CVE-2022-31008 | Medium | 5.5 | 2022-10-06 | RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (li… |
CVE-2022-25625 | High | 8.8 | 2022-08-26 | A malicious unauthorized PAM user can access the administration configuration data and change the values. |
CVE-2022-37049 | High | 7.8 | 2022-08-18 | The component tcpprep in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in parse_mpls at common/get.c:150. NOTE: this is different fro… |
CVE-2022-37048 | High | 7.8 | 2022-08-18 | The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_l2len_protocol at common/get.c:344. NOTE: this is di… |
CVE-2022-37047 | High | 7.8 | 2022-08-18 | The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_ipv6_next at common/get.c:713. NOTE: this is differe… |
CVE-2021-27798 | Medium | 5.5 | 2022-08-05 | A vulnerability in Brocade Fabric OS versions 7.4.1b and 7.3.1d could allow local users to conduct privileged directory transversal. Brocade Fabric OS versions… |
CVE-2021-46825 | Critical | 9.1 | 2022-07-07 | Symantec Advanced Secure Gateway (ASG) and ProxySG are susceptible to an HTTP desync vulnerability. When a remote unauthenticated attacker and other web client… |
CVE-2022-28168 | High | 7.5 | 2022-06-27 | In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an… |
CVE-2022-28167 | Medium | 6.5 | 2022-06-27 | Brocade SANnav before Brocade SANvav v. 2.2.0.2 and Brocade SANanv v.2.1.1.8 logs the Brocade Fabric OS switch password in plain text in asyncjobscheduler-mana… |
CVE-2022-28166 | High | 7.5 | 2022-06-27 | In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Supports the Use of Static Key Ciphers (ss… |
CVE-2021-30651 | Medium | 4.9 | 2022-06-24 | A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that they might not otherwise be authorized to… |
CVE-2022-2068 | High | 7.3 | 2022-06-21 | In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise she… |
CVE-2022-33756 | High | 7.5 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an entropy weakness vulnerability in the Automic AutomationEngine that could allow a remote attacker to potentially… |
CVE-2022-33755 | Medium | 5.3 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insecure input handling vulnerability in the Automic Agent that could allow a remote attacker to potentially enu… |
CVE-2022-33754 | Critical | 9.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote attacker to potential… |
CVE-2022-33753 | High | 8.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insecure file creation and handling vulnerability in the Automic agent that could allow a user to potentially el… |
CVE-2022-33752 | Critical | 9.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote attacker to potential… |
CVE-2022-33751 | High | 7.5 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insecure memory handling vulnerability in the Automic agent that could allow a remote attacker to potentially ac… |
CVE-2022-33750 | Critical | 9.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an authentication error vulnerability in the Automic agent that could allow a remote attacker to potentially execut… |
CVE-2022-33739 | High | 7.5 | 2022-06-16 | CA Clarity 15.8 and below and 15.9.0 contain an insecure XML parsing vulnerability that could allow a remote attacker to potentially view the contents of any f… |
CVE-2022-28162 | Low | 3.3 | 2022-05-09 | Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text. |
CVE-2022-28165 | High | 8.8 | 2022-05-06 | A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an authenticated, remote attacker to acces… |
CVE-2022-28164 | Medium | 6.5 | 2022-05-06 | Brocade SANnav before SANnav 2.2.0 application uses the Blowfish symmetric encryption algorithm for the storage of passwords. This could allow an authenticated… |
CVE-2022-28163 | Critical | 9.8 | 2022-05-06 | In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL injection, allowing an attacker to run… |
CVE-2022-28487 | High | 7.5 | 2022-05-04 | Tcpreplay version 4.4.1 contains a memory leakage flaw in fix_ipv6_checksums() function. The highest threat from this vulnerability is to data confidentiality. |
CVE-2022-27418 | High | 7.8 | 2022-04-12 | Tcpreplay v4.4.1 has a heap-based buffer overflow in do_checksum_math at /tcpedit/checksum.c. |
CVE-2022-27416 | High | 7.8 | 2022-04-12 | Tcpreplay v4.4.1 was discovered to contain a double-free via __interceptor_free. |
CVE-2005-10001 | Medium | 5.4 | 2022-03-28 | A vulnerability was found in Netegrity SiteMinder up to 4.5.1 and classified as critical. Affected by this issue is the file /siteminderagent/pwcgi/smpwservice… |
CVE-2022-27942 | High | 7.8 | 2022-03-26 | tcpprep in Tcpreplay 4.4.1 has a heap-based buffer over-read in parse_mpls in common/get.c. |
CVE-2022-27941 | High | 7.8 | 2022-03-26 | tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_l2len_protocol in common/get.c. |
CVE-2022-27940 | High | 7.8 | 2022-03-26 | tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_ipv6_next in common/get.c. |
CVE-2022-27939 | Medium | 5.5 | 2022-03-26 | tcprewrite in Tcpreplay 4.4.1 has a reachable assertion in get_layer4_v6 in common/get.c. |
CVE-2021-4197 | High | 7.8 | 2022-03-23 | An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some les… |
CVE-2022-25484 | Medium | 5.5 | 2022-03-22 | tcpprep v4.4.1 has a reachable assertion (assert(l2len > 0)) in packet2tree() at tree.c in tcpprep v4.4.1. |
CVE-2021-27789 | Medium | 6.5 | 2022-03-18 | The Web application of Brocade Fabric OS before versions Brocade Fabric OS v9.0.1a and v8.2.3a contains debug statements that expose sensitive information to t… |
CVE-2020-15388 | Medium | 6.5 | 2022-03-18 | A vulnerability in the Brocade Fabric OS before Brocade Fabric OS v9.0.1a, v8.2.3, v8.2.0_CBN4, and v7.4.2h could allow an authenticated CLI user to abuse the… |
CVE-2021-27797 | Critical | 9.8 | 2022-02-21 | Brocade Fabric OS before Brocade Fabric OS v8.2.1c, v8.1.2h, and all versions of Brocade Fabric OS v8.0.x and v7.x contain documented hard-coded credentials, w… |
CVE-2021-27796 | Medium | 6.5 | 2022-02-21 | A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell envir… |
CVE-2021-30650 | Medium | 6.1 | 2022-02-18 | A reflected cross-site scripting (XSS) vulnerability in the Symantec Layer7 API Management OAuth Toolkit (OTK) allows a remote attacker to craft a malicious UR… |
CVE-2022-23992 | Critical | 9.8 | 2022-02-14 | XCOM Data Transport for Windows, Linux, and UNIX 11.6 releases contain a vulnerability due to insufficient input validation that could potentially allow remote… |
CVE-2021-45387 | Medium | 5.5 | 2022-02-11 | tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c. |
CVE-2021-45386 | Medium | 5.5 | 2022-02-11 | tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv6() at tree.c |
CVE-2022-22689 | High | 8.8 | 2022-02-04 | CA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a vulnerability in the CSV export functionality, due to insufficient in… |
CVE-2022-23083 | Medium | 6.1 | 2022-01-18 | NetMaster 12.2 Network Management for TCP/IP and NetMaster File Transfer Management contain a XSS (Cross-Site Scripting) vulnerability in ReportCenter UI due t… |
CVE-2022-23305 | Critical | 9.8 | 2022-01-18 | By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLay… |
CVE-2022-23302 | High | 8.8 | 2022-01-18 | JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the… |
CVE-2021-44050 | Medium | 6.5 | 2021-12-02 | CA Network Flow Analysis (NFA) 21.2.1 and earlier contain a SQL injection vulnerability in the NFA web application, due to insufficient input validation, that… |
CVE-2021-42775 | Critical | 9.1 | 2021-11-12 | Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a vulnerab… |