Brocade Fabric OS Operating System Command Injection Vulnerability

Brocade Fabric OS FOS is a set of embedded operating systems used in devices such as switches and routers from Brocade USA. A security vulnerability exists in Brocade Fabric OS versions 9.1.0 through 9.1.1, which stems from an elevation of privilege vulnerability in the fosexec command. An attack...

PT-2023-23316 · Brocade · Brocade Fabric Os

Name of the Vulnerable Software and Affected Versions: Brocade Fabric OS versions prior to 9.1.1c Brocade Fabric OS versions prior to 9.2.0 Description: The issue allows a local user to dump files under the user's home directory using the grep command. This is due to a vulnerability in the comman...

PT-2023-23315 · Brocade · Brocade Fabric Os

Name of the Vulnerable Software and Affected Versions: Brocade Fabric OS versions prior to 9.1.1c Brocade Fabric OS version 9.2.0 Description: The issue allows an authenticated, local user with knowledge of full path names inside Brocade Fabric OS to execute any command regardless of assigned...

HPESBST04494 rev.1 - HPE Fibre Channel and SAN Switches with Brocade Fabric OS (FOS), Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Escalation of Privilege; Remote: Disclosure of Information, Disclosure of Sensitive Information, Buffer Overflow SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Brocade 16Gb Fibre Channel SAN Switch Module for HPE Synergy -...

CVE-2023-34362 - a SQL injection vulnerability has been found in the MOVEit Transfer web application.

In Progress MOVEit Transfer before 2021.0.6 13.0.6, 2021.1.4 13.1.4, 2022.0.4 14.0.4, 2022.1.5 14.1.5, and 2023.0.1 15.0.1, a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database...

Certificate validation is disabled when requesting binaries

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. Products Confirmed Not Affected No Brocade Fibre Channel Products from Broadcom products are known to be affected by this vulnerability...

CVE-2018-16850 - SQL injection in pg_upgrade and pg_dump, via CREATE TRIGGER ... REFERENCING.

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pgupgrade and pgdump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.More at:...

CVE-2022-42004 -In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check-in BeanDeserializer.deserializeFromArray to prevent the use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization. Products Confirmed No...

CVE-2022-43551 - HSTS check could be bypassed to trick it to keep using HTTP.

A vulnerability exists in curl 7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypasse...

Security Bulletin: IBM b-type SAN Network/Storage switches is affected by a denial of service vulnerability, caused by a CPU consumption in the IPv6 stack (CVE-2017-6227).

Summary IBM b-type SAN Network/Storage switches has addressed the following vulnerability. Fabric OS is vulnerable to a denial of service, caused by a CPU consumption in the IPv6 stack. By sending-crafted Router Advertisement RA messages, a remote attacker could exploit this vulnerability to caus...

Security Bulletin: Vulnerability in SSLv3 affects IBM SAN b-type switches and directors (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM SAN b-type switches and directors. Vulnerability Details CVE-ID : CVE-2014-3566 DESCRIPTION : Product could allow a remote attacker to obta...

Security Bulletin: IBM b-type SAN directors and switches is affected by privilege escalation vulnerability (CVE-2016-8202).

Summary IBM b-type SAN directors and switches has addressed the privilege escalation vulnerability CVE-2016-8202. Vulnerability Details CVEID:CVE-2016-8202 DESCRIPTION: Brocade Fabric OS could allow a remote authenticated attacker to gain elevated privileges on the system. By sending...

Security Bulletin: Vulnerability in Fabric OS firmware used by IBM b-type SAN directors and switches [CVE-2022-33186]

Summary Public disclosed vulnerability in the Fabric OS FOS used by IBM b-type SAN directors and switches. The vulnerability has been addressed and can be resolved by applying one of the FOS code levels listed below. CVE-2022-33186 Vulnerability Details CVEID:CVE-2022-33186 DESCRIPTION: Broadcom...

The vulnerability of the implementation of the AAA TACACS+ protocol in the Brocade Fabric OS operating system allows a intruder to trigger a service failure.

The vulnerability of the aaa tacacs+ protocol implementation in the Brocade Fabric OS operating system is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

CVE-2022-33187

Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information...

CVE-2022-33187

Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information...

Information disclosure

Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information...

CVE-2022-33187 Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs

Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information...

CVE-2022-33187

The CVE-2022-33187 issue affects Brocade SANnav before v2.2.1. Root cause: usernames and encoded passwords are logged in debug-enabled logs, allowing an admin with privileges to read sensitive information. Impact details consistently mention potential exposure of credentials within logs. The prac...

CVE-2022-33187 Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs

Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information...