CVE-2019-16207

Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database and gain privileges...

CVE-2019-16206

The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' logging level; which could allow a local authenticated attacker to access sensitive information...

CVE-2019-16207

Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database and gain privileges...

Authentication flaw

The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' logging level; which could allow a local authenticated attacker to access sensitive information...

Design/Logic Flaw

A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to perform a man-in-the-middle attack against Secure Sockets LayerSSLconnections...

Session fixation

A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insufficiently random session ID for several post-authentication actions in the SANnav portal...

Cross site scripting

Password-based encryption PBE algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptographic keys that may allow an attacker to decrypt passwords used with several services Radius, TACAS, etc...

Default credentials

Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save...

Hardcoded credentials

Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database and gain privileges...

CVE-2019-16209

The CVE-2019-16209 issue affects Broadcom/Brocade SANnav (ReportsTrustManager class) prior to version 2.0. The vulnerability enables MITM attacks by bypassing/d efficiently disabling certificate validation for SSL connections, compromising confidentiality and integrity. Root cause: improper certi...

CVE-2019-16209

A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to perform a man-in-the-middle attack against Secure Sockets LayerSSLconnections...

CVE-2019-16206

The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' logging level; which could allow a local authenticated attacker to access sensitive information...

CVE-2019-16206

CVE-2019-16206 affects Broadcom/Brocade SANnav prior to version 2.0. The authentication mechanism logs plaintext account credentials at the trace and debug levels, enabling a local authenticated attacker to access sensitive information via log files. This information-disclosure flaw is consistent...

CVE-2019-16205

CVE-2019-16205 affects Broadcom/Brocade SANnav prior to version 2.0. The issue is a weak, insufficiently random session ID used for several post-authentication actions in the SANnav portal, enabling remote attackers to brute-force a valid session ID (session hijacking risk). Affected product: SAN...

CVE-2019-16205

A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insufficiently random session ID for several post-authentication actions in the SANnav portal...

CVE-2019-16210

Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save...

CVE-2019-16210

Brocade SANnav vulnerable before v2.0 exposes a plain-text database connection password in logs when triggering the support save. Root cause is logging sensitive information; impact is information disclosure with high confidentiality risk. Remediation: upgrade SANnav to v2.0 or later (as noted in...

CVE-2019-16208

CVE-2019-16208 concerns Broadcom/Brocade SANnav prior to version 2.0, where the underlying password-based encryption (PBE) key-generation process is weak. This weakness may allow an attacker to decrypt passwords used by several services (e.g., Radius, TACACS) due to insufficient cryptographic str...

CVE-2019-16208

Password-based encryption PBE algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptographic keys that may allow an attacker to decrypt passwords used with several services Radius, TACAS, etc...

CVE-2019-16207

Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database and gain privileges...