CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4282 – Weak TLS Ciphers on Brocade SANnav OVA SSH port 22
https://notcve.org/view.php?id=CVE-2024-4282
14 Feb 2025 — Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22. • https://support.broadcom.com/external/content/SecurityAdvisories/0/25400 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-10405 – Weak TLS Ciphers on Brocade SANnav port 443 & 18082
https://notcve.org/view.php?id=CVE-2024-10405
14 Feb 2025 — Brocade SANnav before SANnav 2.3.1b enables weak TLS ciphers on ports 443 and 18082. In case of a successful exploit, an attacker can read Brocade SANnav data stream that includes monitored Brocade Fabric OS switches performance data, port status, zoning information, WWNs, IP Addresses, but no customer data, no personal data and no secrets or passwords, as it travels across the network. • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25402 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2240 – Docker implementation in Brocade SANnav is missing Audit Rules.
https://notcve.org/view.php?id=CVE-2024-2240
14 Feb 2025 — Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various attacks. • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25401 • CWE-250: Execution with Unnecessary Privileges •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2025-1053 – Brocade SANnav encryption key is logged in the debug logs
https://notcve.org/view.php?id=CVE-2025-1053
14 Feb 2025 — Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave. An attacker with privileged access to the Brocade SANnav database could use the encryption key to obtain passwords used by Brocade SANnav. • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25399 • CWE-1295: Debug Messages Revealing Unnecessary Information •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-10404 – Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsave
https://notcve.org/view.php?id=CVE-2024-10404
14 Feb 2025 — CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker to view Brocade Fabric OS switch sensitive information in clear text. An attacker with administrative privileges could retrieve sensitive information including passwords; SNMP responses that contain AuthSecret and PrivSecret after collecting a “supportsave” or getting access to an already collected “supportsave”. NOTE: this issue exists because of an i... • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25403 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43937 – Brocade SANnav Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-43937
21 Nov 2024 — Possible information exposure through log file vulnerability where sensitive fields are recorded in the debug-enabled logs when debugging is turned on in Brocade SANnav before 2.3.0 and 2.2.2a • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22509 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43936 – Brocade Fabric OS switch passwords when debugging is enabled
https://notcve.org/view.php?id=CVE-2022-43936
21 Nov 2024 — Brocade SANnav versions before 2.2.2 log Brocade Fabric OS switch passwords when debugging is enabled. • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21218 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43934 – Weak Key-exchange algorithms
https://notcve.org/view.php?id=CVE-2022-43934
21 Nov 2024 — Brocade SANnav before Brocade SANnav 2.2.2 supports key exchange algorithms, which are considered weak on ports 24, 6514, 18023, 19094, and 19095. • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21220 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43933 – configuration secrets are logged in support-save
https://notcve.org/view.php?id=CVE-2022-43933
21 Nov 2024 — An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are logged in supportsave. Supportsave file is generated by an admin user troubleshooting the switch. The Logged information may include usernames and passwords, and secret keys. • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21221 • CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-2860
https://notcve.org/view.php?id=CVE-2024-2860
08 May 2024 — The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM where the Brocade SANnav is installed can gain access to sensitive data inside the PostgreSQL database. La implementación de PostgreSQL en las versiones de Brocade SANnav anteriores a la 2.3.0a es vulnerable a una falla de autenticación local incorrecta. Un atacante que acceda a la máquina virtual donde está instalado Brocade SANnav puede obtener acceso... • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24260 • CWE-306: Missing Authentication for Critical Function •