1006 matches found
BSA-2017-420
Security Advisory ID : BSA-2017-420 Component : Java Revision : 2.0: Interim Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Serialization. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit:...
BSA-2017-412
Security Advisory ID : BSA-2017-412 Component : Java Revision : 2.0: Interim Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit...
BSA-2017-407
Security Advisory ID : BSA-2017-407 Component : Java Revision : 2.0: Interim Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JAXP. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable...
BSA-2017-415
Security Advisory ID : BSA-2017-415 Component : Java Revision : 2.0: Interim Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit...
BSA-2017-379
Security Advisory ID : BSA-2017-379 Component : OpenVPN Revision : 1.0: Interim OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker. Affected Products Brocade is investigating its product...
BSA-2017-338
Security Advisory ID : BSA-2017-338 Component : N/A Revision : 1.0: Final A ransomware calledWannaCryinfected computers in several countries. Computers that became infected had not been patched. Microsoft released a security bulletin on March 14th, 2017, titled Microsoft Security Bulletin MS17-01...
BSA-2017-308
Security Advisory ID : BSA-2017-308 Component : Java Revision : 2.0: Interim Vulnerability in the Java SE, Java SE Embedded,JRockitcomponent of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111;JRockit:...
BSA-2016-007
Summary Security Advisory ID : BSA-2016-007 Component : Kernel Revision : 2.0 N/A...
BSA-2015-007
Summary Security Advisory ID : BSA-2015-007 Component : RC4 Algorithm Revision : 6.0 N/A...
BSA-2015-006
Summary Security Advisory ID : BSA-2015-006 Component : OpenSSL Revision : 8.0 N/A...
Authentication & Authorization Bypass in Fibre Channel vendor-unique CT (Common Transport)
: A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT Common Transport management requests to bypass administrati...
A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1 (CVE-2026-94583)
: A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists between when a request populates the address variable an...
An authorization logic vulnerability in the Brocade Fabric OS AAA interface (CVE-2026-94578)
: Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA Authentication, Authorization, and Accounting integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific...
Brocade Fabric OS command injection vulnerability in PAM session cleanup routines (CVE-2026-94579)
: An OS command injection vulnerability exists in the PAM Pluggable Authentication Module session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service...
Unprivileged Local Execution of Kernel-Level Diagnostic Tests within Brocade Fabric OS
: An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset...
Multiple Vulnerabilities in Dnsmasq (CVE-2026-4890, CVE-2026-4891, CVE-2026-42959, CVE-2026-4892, CVE-2026-4893)
Brocade is issuing a security advisory addressing multiple vulnerabilities identified in dnsmasq component used across affected products. These vulnerabilities range from memory corruption and heap-based out-of-bounds reads/writes to uncontrolled resource consumption leading to Denial of Service...
Unauthenticated path traversal vulnerability exists in the Brocade ASCG (CVE-2026-85487)
A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...
Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav
Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the...
In OpenSSH before 10.3, a file downloaded by scp -0 as root can lead to privileged escalation
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O legacy scp protocol and without -p preserve mode...
The _rl_tropen function in util.c in GNU readline before 6.3 patch 3
The rltropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.PID file...
CVE-2021-39275. ap_escape_quotes buffer overflow
Security Advisory ID : BSA-2022-1599 Component : Apache httpd Revision : 1.1 An out-of-bounds write in function apescapequotes of httpd allows an unauthenticated, remote attacker to crash the server or potentially execute code on the system with the privileges of the httpd user, by providing...
CVE-2021-34798. NULL pointer dereference in httpd core.
Security Advisory ID : BSA-2022-1597 Component : Apache httpd Revision : 1.0 Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier. Affected Products All versions of Brocade Fabric OS...
BSA-2020-1045
Security Advisory ID : BSA-2020-1045 Component : Apache Tomcat Revision : 1.0: Final The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The...
BSA-2018-710
Security Advisory ID : BSA-2018-710 Component : Apache HTTPD Revision : 1.0: Final In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only...
BSA-2018-696
Security Advisory ID : BSA-2018-696 Component : Kernel Revision : 1.0: Final A TCP data structure in supported versions of FreeBSD 11, 11.1, 11.2, 10, and 10.4 use an inefficient algorithm to reassemble the data. This causes the CPU time spent on segment processing to grow linearly with the numbe...
BSA-2018-601
Security Advisory ID : BSA-2018-601 Component : Kernel Revision : 1.0: Final In some circumstances, some operating systems or hypervisors may not expect or properly handle an Intel architecture hardware debug exception. The error appears to be due to developer interpretation of existing...
CVE-2017-3737 - Read, write after SSL object in error state. (BSA-2018-527).
Security Advisory ID: BSA-2018-527 Component: OpenSSL Revision : 3.0: Final OpenSSL 1.0.2 starting from version 1.0.2b introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake, then OpenSSL would move into the error state and would immediately fail i...
BSA-2017-441
Security Advisory ID : BSA-2017-441 Component : Samba Revision : 2.0: Interim It was found that samba did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text. Affected Products...
BSA-2017-376
Security Advisory ID : BSA-2017-376 Component : Apache HTTPD Revision : 3.0: Final When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has been freed, resulting in potentially erratic behavior...
BSA-2017-404
Security Advisory ID : BSA-2017-404 Component : Java Revision : 2.0: Interim Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit:...
BSA-2017-371
Security Advisory ID : BSA-2017-371 Component : OpenSSH Revision : 1.0: Interim ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an ...
BSA-2017-361
Security Advisory ID : BSA-2017-361 Component : Apache HTTPD Revision : 2.0: Final In Apachehttpd2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of theapgetbasicauthpw by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed...
BSA-2017-289
Security Advisory ID : BSA-2017-289 Component : NTP Revision : 1.0: Interim A vulnerability found in the NTP server allows an authenticated remote attacker to crash the daemon by sending an invalid setting viathe :configdirective. Theunpeeroption expects a number or an address as an argument. In...
BSA-2017-281
Security Advisory ID : BSA-2017-281 Component : OpenSSL Revision : 3.0: Final Thedoaproutchfunction in crypto/bio/bprint.cin OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service...
BSA-2016-008
Summary Security Advisory ID : BSA-2016-008 Component : RPC Revision : 1.0 N/A...
BSA-2016-019
Security Advisory ID : BSA-2016-019 Component : OpenSSH Revision : 3.0: Final Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the 1...
BSA-2016-004
Summary Security Advisory ID : BSA-2016-004 Component : OpenSSH Revision : 5.0 N/A...
BSA-2016-001
Summary Security Advisory ID : BSA-2016-001 Component : Java Revision : 2.0 N/A...
BSA-2015-009
Summary Security Advisory ID : BSA-2015-009 Component : Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 Revision : 2.0 N/A...
BSA-2014-001
Summary Security Advisory ID : BSA-2014-001 Component : N/A Revision : 2.0 N/A...
Flaw in how GLib’s GString manages memory when adding data to strings
A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be writte...
Out-of-Bounds Memory Access Leading to Management Interface Denial of Service
: An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated...
Local Privilege Escalation and Configuration Injection in Brocade Fabric OS System Logging Daemon
: A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal inter-process communication IPC channels allow an unprivileged local user to submit malformed logging...
A race condition vulnerability exists in the web management daemon on Brocade Fabric OS versions before 10.0.1 (CVE-2026-94584)
: A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP...
Local Privilege Escalation via Command Injection in Brocade Fabric OS Diagnostic Utility
: An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A...
Command Injection Vulnerabilities in Brocade Fabric OS Management Interface and Authentication Workflows
: Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow...
Multiple OpenSSH Vulnerabilities (CVE-2026-35386, CVE-2026-35414, CVE-2026-35387, CVE-2026-35388)
Brocade is issuing a security advisory regarding multiple security vulnerabilities discovered in OpenSSH. Vulnerability Details CVE-2026-35386: Remote Code Execution via Shell Metacharacters in Usernames Severity / CVSS v3 Base Score: High / 8.1 Common Weakness Enumeration: CWE-287 Improper...
Hardcoded Symmetric Key in Brocade ASCG (CVE-2026-85422)
A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored managemen...
Logic flaw in Brocade SANnav Java cache key handling object comparison handling
A logic flaw in Brocade SANnav Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and...
Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15 fix 3.4.16, 3.3.0–3.3.18 fix 3.3.19, 2.7.0–2.7.32 fix 2.7.33; Cassandra SSL...