By default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859)

By default, SANnav OVA is shipped with root user login enabled. Product Affected All Brocade OVA SANnav versions Mitigation Starting with SANnav OVA version v2.3.0 and later versions, a root account is not required for installation and management of the SANnav. If an administrator is uncomfortabl...

PT-2024-3222 · Brocade · Brocade Sannav

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.3.1 Brocade SANnav version 2.3.0a Description: The issue is related to the class FileTransfer in Brocade SANnav, which uses the ssh-rsa signature scheme with a SHA-1 hash. This could allow a remote,...

The vulnerability of the Brocade Fabric OS operating system arises from the failure to take measures to eliminate special elements used in the operating system command set. This allows attackers to execute arbitrary code and elevate their privileges to the root user level.

The vulnerability of the Brocade Fabric OS exists because measures are not taken to neutralize the special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely and elevate their privileges to the root user...

CVE-2023-5973

Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports display...

CVE-2023-5973

Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports display...

CVE-2023-5973 Truncated port name

Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports display...

CVE-2023-5973

Brocade Fabric OS Web Interface (v9.x and prior to v9.2.0) is affected by CVE-2023-5973 where portName values containing reserved characters are not represented correctly in the UI. An authenticated user could see altered port displays due to this handling issue. The CVE description and related a...

CVE-2023-5973 Truncated port name

Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports display...

Vulnerabilities fixed in Broadcom Brocade Fabric OS

Broadcom has fixed vulnerabilities in Brocade Fabric OS. A malicious party could exploit the vulnerabilities to execute arbitrary code execute arbitrary code on the system, or to manipulate the operation of the system manipulate. To do this, the malicious party does not need prior authentication...

Brocade Fabric OS 访问控制错误漏洞

Brocade Fabric OS FOS is a set of embedded operating systems used in devices such as switches and routers from Brocade USA. A security vulnerability exists in Brocade Fabric OS version v9.x through versions prior to v9.2.0, which stems from the Web interface not properly representing the portName...

CVE-2023-3454

Remote code execution RCE vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to gain root access to the Brocade switch...

CVE-2023-3454

Remote code execution RCE vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to gain root access to the Brocade switch...

CVE-2023-3454

Remote code execution RCE vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to gain root access to the Brocade switch...

CVE-2023-3454

CVE-2023-3454 is a remote code execution flaw in Brocade Fabric OS that affects versions after 9.0 and before 9.2.0. An unauthenticated attacker could execute arbitrary code and gain root access on affected Brocade Fibre Channel switches. Documented impact is high to critical, with disclosures in...

CVE-2023-3454

Remote code execution RCE vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to gain root access to the Brocade switch...

Brocade Fabric OS 操作系统命令注入漏洞

Brocade Fabric OS FOS is a set of embedded operating systems used in devices such as switches and routers from Brocade USA. A security vulnerability exists in Brocade Fabric OS version v9.0 through versions prior to v9.2.0. An attacker could exploit this vulnerability to execute arbitrary code an...

Remote code execution (RCE) vulnerability in Brocade Fabric OS (CVE-2023-3454)

Remote code execution RCE vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow a remote unauthenticated attacker to execute arbitrary code and use this to gain root access to the switch...

Truncated port name (CVE-2023-5973)

Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports display. Note: The vulnerability doesn...

PT-2024-3233 · Brocade · Brocade Sannav

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.3.1 Brocade SANnav version 2.3.0a Description: A vulnerability in Brocade SANnav is related to insufficient protection of registration data in the PostgreSQL component. This could allow a privileged user to...

Privilege escalation vulnerability in Node.js 20 could allow loading arbitrary OpenSSL engines when the experimental permission model is enabled (CVE-2023-30586).

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine API can be used to bypass...