BSA-2017-374

Security Advisory ID : BSA-2017-374 Component : Linux Kernel Revision : 2.0: Interim The doanonymouspage function in mm/memory.c in the Linux kernel before 2.6.27.52, 2.6.32.x before 2.6.32.19, 2.6.34.x before 2.6.34.4, and 2.6.35.x before 2.6.35.2 does not properly separate the stack and the hea...

CVE-2017-10078 - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting). (BSA-2017-403)

Security Advisory ID: BSA-2017-403 Component: Java Revision : 3.0: Final Vulnerability in the Java SE component of Oracle Java SE subcomponent: Scripting. The supported version that is affected is Java SE: 8u131. Easily exploitable vulnerability allows low-privileged attacker with network access...

BSA-2017-422

Security Advisory ID : BSA-2017-422 Component : Java Revision : 2.0: Interim Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: JAX-WS. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit:...

BSA-2017-500

Security Advisory ID : BSA-2017-500 Component : Apache HTTPD Revision : 1.0: Final It was discovered that the modsessioncrypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decryp...

BSA-2017-318

Security Advisory ID : BSA-2017-318 Component : SSH1 Revision : 1.0: Interim The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client challenge response to a target server by creating a Session ID that matches the Session ID of the target, but which uses a...

BSA-2017-316

Security Advisory ID : BSA-2017-316 Component : SNMP Revision : 1.0: Interim In SNMP version 1 & 2 authentication should only accept the value stored in the SNMP agent authentication mechanism. With this vulnerability an attacker can use any value string or integer in order to authenticate the SN...

BSA-2017-292

Security Advisory ID : BSA-2017-292 Component : NTP Revision : 1.0: Interim Stack-based buffer overflow in the Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via an application path on the command line. Affected Products Brocade is...

BSA-2017-273

Security Advisory ID : BSA-2017-273 Component : sshd in OpenSSH Revision : 3.1 sshdinOpenSSHbefore 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related toserverloop.c. Affected...

BSA-2017-268

Security Advisory ID : BSA-2017-268 Component : Linux Kernel Revision : 1.0: Interim Use-after-free vulnerability in mm/percpu.cin the Linux kernel through 4.6 allows local users to cause a denial of service BUG or possibly have unspecified other impact via crafted use of themmapandbpfsystem call...

BSA-2017-241

Security Advisory ID : BSA-2017-241 Component : SNMP Revision : 1.0: Interim SNMP service in Atmel 802.11b VNET-B Access Point 1.3 and earlier, as used inNetgearME102 and Linksys WAP11, accepts arbitrary community strings with requested MIB modifications, which allows remote attackers to obtain...

BSA-2016-1052

Security Advisory ID : BSA-2016-1052 Component : TCP Sequence Number Revision : 4.0: Final A vulnerability was discovered in the Transmission Control Protocol TCP specification RFC 873. TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a...

BSA-2016-006

Summary Security Advisory ID : BSA-2016-006 Component : PHP Revision : 3.0 N/A...

Multiple cURL vulnerabilities identified in Brocade SANnav CVE-2025-13034, CVE-2025-15079, CVE-2025-15224, CVE-2025-14524, CVE-2025-14819, CVE-2025-14017

Multiple Curl vulnerabilities in Brocade Products. CVE-2025-15079 - libssh global knownhosts override When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were...

Rocky Linux security update in Brocade ASCG 3.4.0c (CVE-2025-68724, CVE-2026-23401, CVE-2026-31402, CVE-2025-40252)

CVE-2025-68724- Title: crypto: asymmetrickeys - prevent overflow in asymmetrickeygenerateid Description In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - prevent overflow in asymmetrickeygenerateid Use checkaddoverflow to guard against potential integer...

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent

Brocade Wget contains an improper input validation vulnerability. An attacker could exploit this via theuserinfosubcomponent of a URI to cause insecure behavior which could potentially cause improper authentication, exposure of sensitive information, or other serious data integrity issues...

PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE

pgjdbc, the PostgreSQL JDBC Driver, allows an attacker to inject SQL if using PreferQueryMode=SIMPLE. Note, this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a...

Apache Commons Vulnerabilities (CVE-2024-25710 and CVE-2024-26308)

CVE-2024-25710 Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress. This issue affects Apache Commons Compress from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue. CVE-2024-26308 Allocation of Resources Withou...

OpenJDK Vulnerability Advisory - April 2024

OpenJDK is affected by multiple vulnerabilities. Affected CVEs CVE-2024-21094 CVE-2024-21085 CVE-2024-21011 CVE-2024-21012 CVE-2023-41993 CVE-2024-21003 CVE-2024-21005 CVE-2024-21002 CVE-2024-21004 More information is available at: https://openjdk.org/groups/vulnerability/advisories/2024-04-16...

Azul Zulu Java Multiple Vulnerabilities (2023-10-17). (CVE-2023-22025, CVE-2023-22067, CVE-2023-22081)

The version of Azul Zulu installed on the remote host is prior to 6 6.59.0.14 / 7 7.65.0.14 / 8 8.73.0.12 / 11 11.67.16 / 17 17.45.16 / 21 21.30.16. It is, therefore, affected by multiple vulnerabilities as referenced in the 2023-10-17 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM...

Command or parameter injection via unique embedded switch SNMP commands (CVE-2024-5461)

Implementation of the Simple Network Management Protocol SNMP operating on the Brocade 6547 FC5022 embedded switch blade, makes internal script calls to system.sh from within the SNMP binary. An authenticated attacker could perform command or parameter injection on SNMP operations that are only...

Azul Zulu OpenJDK is affected by multiple vulnerabilities.(2024-04-16).

Azul Zulu multiple vulnerabilities as referenced in the 2024-04-16 advisory. Affected CVEs CVE-2023-41993, CVE-2024-21002, CVE-2024-21004, CVE-2024-21003, CVE-2024-21005, CVE-2024-21011, CVE-2024-21012, CVE-2024-21068, CVE-2024-21085, CVE-2024-21094 CVE | Component| Base Score ---|---|---...

OpenSSL Security Advisory [28th March 2023] (CVE-2023-0465, CVE-2023-0466)

Multiple OpenSSL Vulnerabilities released on28th March 2023 Invalid certificate policies in leaf certificates are silently ignored CVE-2023-0465 ========================================================= Applications that use a non-default option when verifying certificates may be vulnerable to an...

Azul Zulu Java Multiple Vulnerabilities (2023-07-18)

Azul Zulu installed versions prior to 7 7.63.0.14 / 8 8.71.0.14 / 11 11.65.14 / 17 17.43.14 / 20 20.32.12. are affected by multiple vulnerabilities as referenced in the 2023-07-18 advisory. CVE-2023-22006 CVE-2023-22036 CVE-2023-22041 CVE-2023-22043 CVE-2023-22044 CVE-2023-22045 CVE-2023-22049...

Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 (CVE-2015-4042)

Integer overflow in the keycomparemb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service application crash or possibly have unspecified other impact via long strings...

NULL Pointer Exception bug that can be used by a remote attacker

handleipv6IpForwarding in agent/mibgroup/ip-mib/ipscalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. Products Confirmed Not Affected Brocade Fabri...

Rocky Linux Security Updates RLSA-2023:5312 (CVE-2023-20900) and RSLA-2023:5244 (CVE-2023-35001, CVE-2023-4004, CVE-2023-3390, CVE-2023-3776, CVE-2023-3090, CVE-2023-35788, CVE-2023-20593, CVE-2023-2002)

Rocky Linux security update RLSA-2023:5312 CVE-2023-20900 A malicious actor that has been granted Guest Operation Privilegesin a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias Rocky Linux security updat...

The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code (CVE-2014-9471)

The parsedatetime function in GNU coreutils allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command...

CVE-2020-1749 - A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec

A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data...

CVE-2022-33182. Privilege escalation using switch commands "supportlink", "firmwaredownload", "portcfgupload","license", and "fosexec".

Security Advisory ID : BSA-2022-2084 Component : FOS Revision : 2.0 A privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, could allow a local authenticated user to escalate its privilege to root using switch commands "supportlink...

CVE-2022-33184. Stack-based buffer overflows, allowing the execution of arbitrary code.

Security Advisory ID : BSA-2022-2080 Component : FOS Revision : 1.0 A vulnerability in fabseg.c.h libraries of all Brocade Fabric OS versions before Brocade Fabric OS v9.1.1, v9.0.1e, v8.2.3c, v8.2.0cbn5, 7.4.2j could allow local authenticated attackers to exploit stack-based buffer overflows and...

BSA-2022-1832

Security Advisory ID : BSA-2022-1832 Component : NGINX Revision : 1.0 Brocade PSIRT has become aware of thesecurity vulnerabilities in the NGINX LDAP reference implementation publicly shared on09 April 2022. More information is available at "Addressing Security Weaknesses in the NGINX LDAP...

BSA-2021-1721

Security Advisory ID : BSA-2021-1721 Component : shell Revision : 1.0 A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell environment rbash as either the “user” or “factory” account, to...

BSA-2020-1051

Security Advisory ID : BSA-2020-1051 Component : Windows DNS Revision : 1.0: Final A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests. An attacker who successfully exploited the vulnerability could run arbitrary code in th...

BSA-2020-936

Security Advisory ID : BSA-2020-936 Component : SMBv3 Revision : 1.0: Final Microsoft SMBv3 contains a vulnerability in the handling of compression, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft Server Message Block 3.1....

BSA-2020-926

Security Advisory ID : BSA-2020-926 Component : openfortivpn Revision : 1.0: Final tunnel.c mishandles certificate validation in openfortivpn 1.11.0 due to multiples issues. CVE-2020-7041 An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles...

CVE-2019-19317, CVE-2019-19603, CVE-2019-19880 - Multiple vulnerabilities in SQLite 3.30.1. (BSA-2020-895).

Security Advisory ID: BSA-2020-895 Component: SQLite Revision : 2.0: Final Multiplevulnerabilities inSQLite 3.30.1 CVE-2019-19317 lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or...

BSA-2019-866

Security Advisory ID : BSA-2019-866 Component : SANnav Revision : 1.0 Brocade SANnav versions before v2.0 usea hard-coded password, which could allowlocal authenticated attackers to access a back-end database and gain privileges. The vulnerability could be exploited only if the database service i...

BSA-2019-864

Security Advisory ID : BSA-2019-864 Component : SANnav portal Revision : 1.0 A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insufficiently random session ID for several post-authentication...

BSA-2019-767

Security Advisory ID : BSA-2019-767 Component : LIBSSH2 Revision : 1.0: Final libssh2 is a client-side C library implementing the SSH2 protocol.It supports regular terminal, SCP and SFTPsessions; port forwarding, X11 forwarding; password, key-based and keyboard-interactive authentication. Libssh2...

BSA-2019-755

Security Advisory ID : BSA-2019-755 Component : Apache Revision : 1.0: Final Apache 2.4 vulnerabilities in Brocade Fibre Channel Products from Broadcom Multiple Brocade Fibre Channel technology products from Broadcom incorporate Apache httpd 2.4 librairies. Apache released in January 2019, a list...

BSA-2018-711

Security Advisory ID : BSA-2018-711 Component : Apache HTTPD Revision : 1.0: Final The Apache HTTP Server 2.4.17 and 2.4.18, when modhttp2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of servic...

BSA-2018-603

Security Advisory ID : BSA-2018-603 Component : WebGUI Revision : 1.0: Final Multiple GPON Home Routers could allow a remote attacker to bypass security restrictions, caused by a flaw in the authentication mechanism. By appending "?images/" to the end of the web address on any of the router's...

BSA-2018-589

Security Advisory ID : BSA-2018-589 Component : Oracle WebLogic Revision : 1.0: Final Vulnerability in the Oracle WebLogicServer component of Oracle Fusion Middleware subcomponent: WLS Core Components. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily...

BSA-2017-469

Security Advisory ID : BSA-2017-469 Component : JBOSS Application Revision : 1.0: Interim Cross-site request forgery CSRF vulnerability in the Web Console web-console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server before 2.0.0.CR9 allows remo...

BSA-2017-472

Security Advisory ID : BSA-2017-472 Component : JBOSS WildFly Revision : 1.0: Interim Red Hat JBoss Enterprise Application Platform JBEAP 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container MSC service...

BSA-2017-435

Security Advisory ID : BSA-2017-435 Component : Apache HTTPD Revision : 3.0: Final Apachehttpdallows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccessfile, or ifhttpd.confhas certain misconfigurations, akaOptionsbleed. This affects th...

BSA-2017-443

Security Advisory ID : BSA-2017-443 Component : DHCP Revision : 1.0: Interim A resource-consumption flaw was discovered in the DHCP server. dhcpd did not restrict the number of open connections to OMAPI and failover ports. A remote attacker able to establish TCP connections to one of these ports...

BSA-2017-411

Security Advisory ID : BSA-2017-411 Component : Java Revision : 2.0: Interim Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit...

BSA-2017-414

Security Advisory ID : BSA-2017-414 Component : Java Revision : 2.0: Interim Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit...

BSA-2017-417

Security Advisory ID : BSA-2017-417 Component : Java Revision : 2.0: Interim Vulnerability in the Java SE component of Oracle Java SE subcomponent: Deployment. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Easily exploitable vulnerability allows unauthenticated attacke...