10 results · Clear filters · Feed
-
High 8.4
Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav before 3.0.1a
Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written to system logs. Individuals with read access to container logs or support archives can obtain these …
-
High 8.5
Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav before 3.0.1.a
Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can v…
-
High 8.5
Plaintext exposure of sensitive authentication data in SANnav discovery service log files
Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or supp…
-
High 8.6
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to al…
-
High 8.6
Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a
Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permissions can leverage th…
-
High 8.7
Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administra…
-
High 7.1
Plain password is generated in the audit logs while executing update-reports-purge-settings.sh script with Brocade SANnav before 2.4.0a
A vulnerability in update-reports-purge-settings.sh script logging for Brocade SANnav before 2.4.0a could allow the collection of SANnav database password in the system audit logs. The vulnerability could allow a remote authenticated attacker with access to t…
-
High 8.5
Plaintext Switch admin login password is seen in Brocade SANnav support save
Brocade SANnav before 2.4.0b logs the Brocade Fabric OS Switch admin password on the SANnav support save logs. When OOM occurs on a Brocade SANnav server, the call stack trace for the Brocade switch is also collected in the heap dump file which contains this …
-
High 7.1
Plain text pbe key visible in audit log during Brocade SANnav migration from 2.4.0a to 3.0.0
A vulnerability in Brocade SANnav before 2.4.0b prints the Password-Based Encryption (PBE) key in plaintext in the system audit log file. The vulnerability could allow a remote authenticated attacker with access to the audit logs to access the pbe key. Note: …
-
High 8.1
Web authentication and authorization bypass
Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization.