CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-28167
https://notcve.org/view.php?id=CVE-2022-28167
Brocade SANnav before Brocade SANvav v. 2.2.0.2 and Brocade SANanv v.2.1.1.8 logs the Brocade Fabric OS switch password in plain text in asyncjobscheduler-manager.log Brocade SANnav versiones anteriores a Brocade SANvav versión 2.2.0.2 y Brocade SANanv versión 2.1.1.8, registra la contraseña del conmutador Brocade Fabric OS en texto plano en el archivo asyncjobscheduler-manager.log • https://security.netapp.com/advisory/ntap-20220627-0002 https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1978 • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-28166
https://notcve.org/view.php?id=CVE-2022-28166
In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Supports the Use of Static Key Ciphers (ssl-static-key-ciphers) on ports 443 & 18082. En Brocade SANnav versiones anteriores a SANN2.2.0.2 y Brocade SANNav versiones anteriores a 2.1.1.8, la implementación del servidor TLS/SSL admite el uso de cifrados de clave estática (ssl-static-key-ciphers) en los puertos 443 y 18082 • https://security.netapp.com/advisory/ntap-20220627-0001 https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1977 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 10.0EPSS: 12%CPEs: 50EXPL: 0CVE-2022-2068 – The c_rehash script allows command injection
https://notcve.org/view.php?id=CVE-2022-2068
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. • https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2c9c35870601b4a44d86ddbf512b38df38285cfa https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7a9c027159fe9e1bbc2cd38a8a2914bff0d5abd9 https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9639817dac8bbbaa64d09efad7464ccc405527c7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WZZBKUHQFGSKGNXXKICSRPL7AMVW5M5 https://lists.fedoraproject.org/archives/list • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-28162
https://notcve.org/view.php?id=CVE-2022-28162
Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text. Brocade SANnav versiones hasta SANnav 2.2.0, registra el token de autenticación de la API REST en texto plano • https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1841 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-28165
https://notcve.org/view.php?id=CVE-2022-28165
A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actions that they should not be able to perform. The vulnerability exists because restrictions are not performed on Server side to ensure the user has required permission before processing requests. Una vulnerabilidad en la funcionalidad de control de acceso basado en roles (RBAC) de Brocade SANNav versiones anteriores a 2.2.0 podría permitir a un atacante remoto autenticado acceder a recursos a los que no debería poder acceder y llevar a cabo acciones que no debería poder realizar. La vulnerabilidad se presenta porque no son llevados a cabo restricciones en el lado del servidor para asegurar que el usuario presenta permiso requerido antes de procesar las peticiones • https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1844 •