PT-2023-28805

Name of the Vulnerable Software and Affected Versions Broadcom RAID Controller affected versions not specified Description The Broadcom RAID Controller web interface is vulnerable due to an insecure default HTTP configuration that does not safeguard cookies with the Secure attribute...

Broadcom RAID Controller Security Vulnerability

Broadcom RAID Controller is a series of RAID controllers from Broadcom USA. A security vulnerability exists in the Broadcom RAID Controller, which stems from a security flaw in the web interface that allows any local user on Windows to access encryption keys, leading to the disclosure of sensitiv...

Broadcom RAID Controller Encryption Issue Vulnerability

The Broadcom RAID Controller is a series of RAID controllers from Broadcom Corporation USA. A security vulnerability exists in the Broadcom RAID Controller that stems from the web interface's TLS configuration supporting an outdated SHA1 cipher suite, rendering the product susceptible to attack...

CVE-2023-4332: Incorrect Permission Assignment for Critical Resource

Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file...

CVE-2023-4329: Undefined Security Weakness

Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute...

CVE-2023-4324: Undefined Security Weakness

Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers...

CVE-2023-4328: Insufficiently Protected Credentials

Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Windows...

CVE-2023-4343: Undefined Security Weakness

Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameter...

Broadcom RAID Controller Security Feature Issue Vulnerability

The Broadcom RAID Controller is a series of RAID controllers from Broadcom Corporation USA. A security vulnerability exists in the Broadcom RAID Controller that stems from incorrect use of ssl.rnd to set up a CIM connection, which makes the web interface susceptible to insufficient randomization...

PT-2023-28788

Name of the Vulnerable Software and Affected Versions Broadcom RAID Controller Web server nginx affected versions not specified Description The issue concerns the Broadcom RAID Controller Web server, which is based on nginx. It is serving private files without any authentication. Recommendations ...

CVE-2023-4335: Missing Authentication for Critical Function

Broadcom RAID Controller Web server nginx is serving private server-side files without any authentication on Linux...

CVE-2023-4338: Undefined Security Weakness

Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options Headers...

Broadcom RAID Controller Security Vulnerability

The Broadcom RAID Controller is a series of RAID controllers from Broadcom Corporation USA. A security vulnerability exists in the Broadcom RAID Controller that stems from a lack of HTTP strict-transport-security policy in the web interface, which makes the product vulnerable to attack...

CVE-2023-4334: Missing Authentication for Critical Function

Broadcom RAID Controller Web server nginx is serving private files without any authentication...

CVE-2023-4337: Undefined Security Weakness

Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installation...

CVE-2023-4333: Inadequate Encryption Strength

Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server...

CVE-2023-4339: Undefined Security Weakness

Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions...

CVE-2023-4342: Undefined Security Weakness

Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP strict-transport-security policy...

CVE-2023-4341: Undefined Security Weakness

Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUI...

CVE-2023-4344: Insufficient Entropy

Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection...