The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms

OpenSSL contains an issue in the POLY1305 MAC message authentication code implementation that might result in a corrupted internal application state. This flaw is only exploitable on PowerPC CPU based platforms if the CPU provides vector instructions PowerISA 2.07. The impact of the corrupted...

CVE-2022-28169 - Brocade Fabric OS Privilege Escalation Vulnerability (BSA-2022-2075)

Security Advisory ID : BSA-2022-2075 Component : Webtools Revision : 3.1 Brocade Webtools in Brocade Fabric OS versions before Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c could allow a low privilege webtools user to gain elevated admin rights, or privileges, beyond what is intended or...

BSA-2020-1130

Security Advisory ID : BSA-2020-1130 Component : NGINX Revision : 1.0 NGINX before 1.17.7, with certain errorpage configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load...

BSA-2017-244

Security Advisory ID : BSA-2017-244 Component : SNMP Revision : 2.0: Interim An SNMP community name is the default e.g. public, null, or missing. Affected Products Product| Current Assessment ---|--- Brocade Virtual Web Application Firewall| Impacted: Make sure SNMP is not enabled...

BSA-2017-220

Security Advisory ID : BSA-2017-220 Component : ntp Revision : 1.0: Interim The broadcast mode of NTP is expected to only be used in a trusted network. If the broadcast network is accessible to an attacker, a potentially exploitable denial of service vulnerability inntpd'sbroadcast mode replay...

Scan discovered multiple CVEs against glibc

Binary scan of Brocade Fabric OS identified multiple potential CVEs against glibc CVE-2020-6096 An exploitable signed comparison vulnerability exists in the ARMv7 memcpy implementation of GNU glibc 2.30.9000. Calling memcpy on ARMv7 targets that utilize the GNU glibc implementation with a negativ...

Brocade SANnav Vulnerability Disclosures

Brocade Security Advisories posted on July 28, 2026 CVEs addressed in SANnav 3.0.1 and 3.0.0a CVE-2026-5047 base64 encoded password is seen in fe-consolidated logs PSIRT Risk: High https://support.broadcom.com/external/content/SecurityAdvisories/0/37933 CVE-2026-5049 Path traversal via unsanitize...

The encryption key is stored in the DR log files (CVE-2024-29957).

When Brocade SANnav before v2.3.1 and v2.3.0a servers are configured in Disaster Recovery mode, the encryption key is stored in the DR log files. This could provide attackers with an additional, less-protected path to acquiring the encryption key.Products Affected...

Hardcoded TLS keys used by Docker (CVE-2024-29963).

Brocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded TLS keys used by Docker. Brocade SANnav doesn't have access to remote Docker registries, and knowledge of the keys is a minimal risk as SANnav is prevented from communicating with Docker registries VEX code:...

CVE-2023-31926 - Arbitrary File Overwrite using less command

System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0...

Flaw in glib could leak content from files owned by privileged users to unprivileged ones.

A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition...

Security updates provided in Brocade Fabric OS v9.2.0, v9.1.1c, v8.2.3d

Dear Brocade Customer: This Advisory aims to inform you of Brocade Fabric OS Security updates in Brocade Fabric OS v9.2.0, v9.1.1c, and v8.2.3d. Please review the recently posted security advisories listed here: Updated Security Advisories...

CVE-2022-33178. A vulnerability in the radius authentication system could allow arbitrary code execution.

Security Advisory ID : BSA-2022-2077 Component : FOS Revision : 1.0 A vulnerability in the radius authentication system of Brocade Fabric OS before Brocade Fabric OS 9.0 could allow a remote attacker to execute arbitrary code on the Brocade switch. Due to improper input validation, the privileged...

CVE-2022-33180. Sensitive files export.

Security Advisory ID : BSA-2022-2082 Component : FOS Revision : 1.1 A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5 could allow a local authenticated attacker to export out sensitive files with “seccryptocfg”, “configupload”. Affected...

BSA-2020-1083

Security Advisory ID : BSA-2020-1083 Component : secccrypptocfg Revision : 2.0 Brocade Fabric OS before v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0CBN3, v7.4.2g contains an improper input validation weakness in the command line interface when secccrypptocfg is invoked. The vulnerability could allow...

BSA-2020-1076

Security Advisory ID : BSA-2020-1076 Component : Database credentials Revision : 1.1 Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An unauthenticated malicious user with access to th...

BSA-2018-698

Security Advisory ID : BSA-2018-698 Component : OpenSSH Revision : 2.0: Final OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c...

BSA-2018-525

Security Advisory ID : BSA-2018-525 Component : Fabric OS Web GUI Revision : 1.0: Initial XSS vulnerabilities in the web-based management interface of Brocade Fibre Channel SAN products running Brocade Fabric OS FOS could allow remote unauthenticated attackers to execute arbitrary script code in...

BSA-2017-327

Security Advisory ID : BSA-2017-327 Component : JAVA SE Networking Revision : 3.0: Final Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficul...

BSA-2017-179

Security Advisory ID : BSA-2017-179 Component : BNA Revision : 1.0: Final A Directory Traversal Vulnerability in servletSoftwareImageUploadin the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to write to arbitrary files, and consequently dele...

Checking excessively long DSA keys or parameters may be very slow

OpenSSL contains an unbounded computation flaw when performing checks on excessively large DSA keys or parameters, which could lead to a denial-of-service DoS attack. The OpenSSL pkey, pkeyparam command line apps, and FIPS providers are affected...

close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE

GNU is vulnerable to command injection due to missing sanitization of filenames when the LESSCLOSE environment variable is set and invoked. This could allow an attacker to execute malicious commands within the privileges of the utility...

PostgreSQL vulnerability in SANnav 2.2.0.2

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the objec...

BSA-2020-973

Security Advisory ID : BSA-2020-973 Component : jQuery Revision : 1.0 In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e..html, .append, and others...

BSA-2021-1493

Security Advisory ID : BSA-2021-1493 Component : CLI Revision : 1.1 A vulnerability in the Brocade Fabric OS before Brocade Fabric OS v9.0.1a, v8.2.3, v8.2.0CBN4,and v7.4.2h could allow an authenticated CLI user to abuse the history command to write arbitrary content to files. Affected Products...

BSA-2018-527

Summary OpenSSL 1.0.2 starting from version 1.0.2b introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for...

BSA-2017-264

Security Advisory ID : BSA-2017-264 Component : OpenSSL Revision : 1.0: Interim During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake or vice-versa then this can cause OpenSSL to crash dependent onciphersuite. Both clients and...

BSA-2017-255

Security Advisory ID : BSA-2017-255 Component : OpenSSH Revision : 2.0: Final Thekbdintnextdevicefunction in auth2-chall.c insshdinOpenSSHthrough 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to...

BSA-2017-207

Security Advisory ID : BSA-2017-207 Component : OpenSSL Revision : 1.0: Interim Severity: Low-There is a carry propagating bug in the Broadwell-specific Montgomerymultiplication procedure that handles input lengths divisible by, butlonger than 256 bits. Analysis suggests that attacks against RSA,...

BSA-2016-198

Security Advisory ID : BSA-2016-198 Component : curl/libcurl Revision : 2.0: Final Use-after-free vulnerability inlibcurlbefore 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors...

Multiple Linux Security Updates applied to Brocade Fabric OS 10.0

Multiple Linux Security Updates applied to Brocade Fabric OS 10.0.0. While the Brocade Fabric OS is not affected by any of these public vulnerabilities, security updates have been applied as part of a proactive security practice CVE-2024-26596 Brocade Fabric OS before 10.0.0 not affected VEX...

unauthenticated remote code execution vulnerability in React Server Components. React (CVE-2025-55182), Next.js (CVE-2025-66478).

CVE-2025-55182 Description: A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable co...

SQL Table names, column names, and SQL queries are collected in DR standby Supportsave (CVE-2024-29968)

An information disclosure vulnerability exists in Brocade SANnav before v2.3.1 and v2.3.0a when Brocade SANnav instances are configured in disaster recovery mode. SQL Table names, column names, and SQL queries are collected in DR standby Supportsave. This could allow authenticated users to access...

An Improper Input Validation vulnerability for the registered case credentials (CVE-2023-5649)

An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow a local authenticated user to provide invalid inputs like special characters leading to a Denial of Service DoS when collecting “supportsave” from a Brocade Switch...

BSA-2018-540

Security Advisory ID : BSA-2018-540 Component : OpenSSH Revision : 2.0: Final The 1 roamingread and 2 roamingwrite functions in roamingcommon.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file...

BSA-2018-636

Security Advisory ID : BSA-2018-636 Component : OpenSSL Revision : 2.0: Final The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process coul...

BSA-2017-208

Security Advisory ID : BSA-2017-208 Component : FOS Revision : 2.0: Interim A privilege escalation vulnerability in BrocadeFibreChannel SAN products running Brocade Fabric OS FOS releases earlier than v7.4.1d and v8.0.1b could allow an authenticated, attacker to elevate the privileges of user...

BSA-2017-248

Security Advisory ID : BSA-2017-248 Component : IPV6 Revision : 1.0: Interim An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big PTB messages. The scope of this CVE is all affected IPv6 implementations from all vendors. The security implications of IP...

BSA-2017-227

Security Advisory ID : BSA-2017-227 Component : ntp Revision : 1.0: Interim Bug 2085 described a condition where the root delay was included twice, causing the jitter value to be higher than expected. Due to a misinterpretation of a small-print variable in The Book, the fix for this problem was...

BSA-2016-209

Security Advisory ID : BSA-2016-209 Component : Web UI Revision : 1.0: Final A CSRF vulnerability in Brocade Virtual Traffic Manager versions released prior to and including 11.0, could allow an attacker to trick a logged-in user into making administrative changes on the traffic manager cluster...

BSA-2017-177

Security Advisory ID : BSA-2017-177 Component : BNA Revision : 1.0: Final A Directory Traversal Vulnerability inFileReceiveServletin the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to upload malicious file in a section of the file system...

crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)

In the Linux kernel, the following vulnerability has been resolved: crypto: algifaead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algifaead since the source and destination...

AIDE Vulnerable to Improper Output Neutralization via Terminal Escape Sequences in Log and Report Output

AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamp...

Security update provided for multiple Go Open-source programming language

Security update provided for multiple Go Open-source programming language. CVE-2025-22871 Affects: net/http/internal The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjuncti...

Spring Framework DoS (CVE-2024-38808, CVE-2024-38809 and CVE-2024-22262)

The Spring Framework vulnerabilities identified are located within open source components utilized by Brocade SANnav, however none of these vulnerabilities are in the executable code path. As a part of good security practice, the open source component was updated in the Brocade SANnav 3.0.0...

A malicious rsh server can overwrite arbitrary files in a directory on the rcp client machine

An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned. A malicious rsh server or Man-in-The-Middle attacker can overwrite...

use-after-free and memory corruption

The tcpmssmanglepacket function in net/netfilter/xtTCPMSS. c in the Linux kernel before 4.11, and 4.9. x before 4.9. 36, allows remote attackers to cause a denial of service use-after-free and memory corruption or possibly have unspecified other impact by leveraging the presence of xtTCPMSS in an...

By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container (CVE-2024-29018)

github.com/docker/docker/libnetwork is a package that provides a native Go implementation for connecting containers Affected versions of this package are vulnerable to Improper Control of a Resource Through its Lifetime, allowing DNS requests from internal networks to be forwarded to an external...

CVE-2022-33179. A vulnerability in Brocade Fabric OS CLI could allow an attacker to break out of restricted shells and escalate privileges

Security Advisory ID : BSA-2022-2079 Component : FOS Revision : 1.1 A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, and 7.4.2j could allow a local authenticated user to break out of restricted shells with “set context” and escalate privileges. Affecte...

CVE-2022-33185. Several commands in Brocade Fabric OS use unsafe string function to process user input

Security Advisory ID : BSA-2022-2078 Component : FOS Revision : 1.1 Several commands in Brocade Fabric OS before Brocade Fabric OS v.9.0.1e, v9.1.0 use unsafe string functions to process user input. Authenticated local attackers could abuse these vulnerabilities to exploit stack-based buffer...