CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29953 – Encoded session passwords on session storage for Virtual Fabric platforms
https://notcve.org/view.php?id=CVE-2024-29953
25 Jun 2024 — A vulnerability in the web interface in Brocade Fabric OS before v9.2.1, v9.2.0b, and v9.1.1d prints encoded session passwords on session storage for Virtual Fabric platforms. This could allow an authenticated user to view other users' session encoded passwords. Una vulnerabilidad en la interfaz web en Brocade Fabric OS anterior a v9.2.1, v9.2.0b y v9.1.1d imprime contraseñas de sesión codificadas en el almacenamiento de sesiones para plataformas Virtual Fabric. Esto podría permitir que un usuario autentica... • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23227 • CWE-922: Insecure Storage of Sensitive Information •
CVSS: 10.0EPSS: 17%CPEs: 3EXPL: 0CVE-2024-37079
https://notcve.org/view.php?id=CVE-2024-37079
18 Jun 2024 — vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution. vCenter Server contiene una vulnerabilidad de desbordamiento de montón en la implementación del protocolo DCERPC. Un actor malintencionado con acceso a la red de vCenter Server puede desencadenar esta vulnerabilidad al enviar un paqu... • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453 • CWE-787: Out-of-bounds Write •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36459 – Cross-Site Scripting Vulnerability in Symantec SiteMinder Web Agent
https://notcve.org/view.php?id=CVE-2024-36459
14 Jun 2024 — A CRLF cross-site scripting vulnerability has been identified in certain configurations of the SiteMinder Web Agent for IIS Web Server and SiteMinder Web Agent for Domino Web Server. As a result, an attacker can execute arbitrary Javascript code in a client browser. Se ha identificado una vulnerabilidad de cross-site scripting CRLF en determinadas configuraciones del Agente web de SiteMinder para el servidor web IIS y del Agente web de SiteMinder para el servidor web Domino. Como resultado, un atacante pued... • https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1 • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') •
CVSS: 9.0EPSS: 56%CPEs: 3EXPL: 4CVE-2024-22274
https://notcve.org/view.php?id=CVE-2024-22274
21 May 2024 — The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system. vCenter Server contiene una vulnerabilidad de ejecución remota de código autenticado. Un actor malintencionado con privilegios administrativos en el shell del dispositivo vCenter puede aprovechar este problema para ejecutar comandos arbitrarios en el sistema operat... • https://github.com/mbadanoiu/CVE-2024-22274 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-2860
https://notcve.org/view.php?id=CVE-2024-2860
08 May 2024 — The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM where the Brocade SANnav is installed can gain access to sensitive data inside the PostgreSQL database. La implementación de PostgreSQL en las versiones de Brocade SANnav anteriores a la 2.3.0a es vulnerable a una falla de autenticación local incorrecta. Un atacante que acceda a la máquina virtual donde está instalado Brocade SANnav puede obtener acceso... • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24260 • CWE-306: Missing Authentication for Critical Function •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2859 – By default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859)
https://notcve.org/view.php?id=CVE-2024-2859
27 Apr 2024 — By default, SANnav OVA is shipped with root user login enabled. While protected by a password, access to root could expose SANnav to a remote attacker should they gain access to the root account. De forma predeterminada, SANnav OVA se envía con el inicio de sesión de usuario raíz habilitado. Si bien está protegido por una contraseña, el acceso a la cuenta raíz podría exponer a SANnav a un atacante remoto en caso de que obtenga acceso a la cuenta raíz. • https://security.netapp.com/advisory/ntap-20240628-0003 • CWE-276: Incorrect Default Permissions •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4161 – Syslog traffic sent in clear-text
https://notcve.org/view.php?id=CVE-2024-4161
25 Apr 2024 — In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitive information. En Brocade SANnav, antes de Brocade SANnav v2.3.0, el tráfico de syslog recibía texto plano. Esto podría permitir que un atacante remoto no autenticado capture información confidencial. • https://support.broadcom.com/external/content/SecurityAdvisories/0/23284 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4159 – Protection mechanisms
https://notcve.org/view.php?id=CVE-2024-4159
25 Apr 2024 — Brocade SANnav before v2.3.0a lacks protection mechanisms on port 2377/TCP and 7946/TCP, which could allow an unauthenticated attacker to sniff the SANnav Docker information. Brocade SANnav anterior a Brocade SANnav v2.3.1 carece de mecanismos de protección en los puertos 2377/TCP y 7946/TCP, lo que podría permitir que un atacante remoto no autenticado acceda a las API de Kafka y envíe datos maliciosos. • https://support.broadcom.com/external/content/SecurityAdvisories/0/23282 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-29969 – TLS/SSL weak message authentication code ciphers are added by default for port 18082
https://notcve.org/view.php?id=CVE-2024-29969
19 Apr 2024 — When a Brocade SANnav installation is upgraded from Brocade SANnav v2.2.2 to Brocade SANnav 2.3.0, TLS/SSL weak message authentication code ciphers are added by default for port 18082. Cuando se actualiza una instalación de Brocade SANnav de Brocade SANnav v2.2.2 a Brocade SANnav 2.3.0, los cifrados de códigos de autenticación de mensajes débiles TLS/SSL se agregan de forma predeterminada para el puerto 18082. • https://support.broadcom.com/external/content/SecurityAdvisories/0/23251 • CWE-326: Inadequate Encryption Strength •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29968 – SQL Table names, column names, and SQL queries are collected in DR standby Supportsave
https://notcve.org/view.php?id=CVE-2024-29968
19 Apr 2024 — An information disclosure vulnerability exists in Brocade SANnav before v2.3.1 and v2.3.0a when Brocade SANnav instances are configured in disaster recovery mode. SQL Table names, column names, and SQL queries are collected in DR standby Supportsave. This could allow authenticated users to access the database structure and its contents. Existe una vulnerabilidad de divulgación de información en Brocade SANnav anterior a v2.3.1 y v2.3.0a cuando las instancias de Brocade SANnav están configuradas en modo de r... • https://support.broadcom.com/external/content/SecurityAdvisories/0/23253 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-922: Insecure Storage of Sensitive Information •