CveMateVulnerability intelligence

Broadcom Brocade Sannav vulnerabilities, page 3

58 vulnerabilities

Known vulnerabilities in Broadcom Brocade Sannav, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

CVE-2024-10405broadcombrocade_sannav+11y ago14-02-2025 23:23

Brocade SANnav before SANnav 2.3.1b enables weak TLS ciphers on ports 443 and 18082. In case of a successful exploit, an attacker can read Brocade SANnav data stream that includes monitored Brocade Fabric OS switches performance data, port status, zoning information, WWNs, IP Addresses, but no customer data, no personal data and no secrets or passwords, as it travels across the network.CVE-2024-10404broadcombrocade_sannav+11y ago14-02-2025 03:13

CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker to view Brocade Fabric OS switch sensitive information in clear text. An attacker with administrative privileges could retrieve sensitive information including passwords; SNMP responses that contain AuthSecret and PrivSecret after collecting a “supportsave” or getting access to an already collected “supportsave”. NOTE: this issue exists because of an incomplete fix for CVE-2024-29952 CVE-2024-3596alpinefreeradius+752y ago09-07-2024 12:02

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.CVE-2019-16205broadcombrocade_sannav+16y ago08-11-2019 17:17

A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insufficiently random session ID for several post-authentication actions in the SANnav portal.CVE-2019-16208broadcombrocade_sannav+16y ago08-11-2019 17:03

Password-based encryption (PBE) algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptographic keys that may allow an attacker to decrypt passwords used with several services (Radius, TACAS, etc.).CVE-2019-16207broadcombrocade_sannav+16y ago08-11-2019 17:02

Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database and gain privileges.CVE-2019-16206broadcombrocade_sannav+16y ago08-11-2019 17:18

The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' logging level; which could allow a local authenticated attacker to access sensitive information.CVE-2019-16212broadcombrocade_sannav6y ago25-09-2020 13:07

A vulnerability in Brocade SANnav versions before v2.1.0 could allow a remote authenticated attacker to conduct an LDAP injection. The vulnerability could allow a remote attacker to bypass the authentication process.CVE-2019-16211broadcombrocade_sannav6y ago25-09-2020 13:08

Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability.CVE-2019-16209broadcombrocade_sannav+16y ago08-11-2019 17:19

A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to perform a man-in-the-middle attack against Secure Sockets Layer(SSL)connections.CVE-2019-16210broadcombrocade_sannav+16y ago08-11-2019 17:05

Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save.CVE-2026-5769broadcombrocade_sannav+113d ago08-10-2026 06:07

A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the Brocade SANnav Virtual Machine (VM). This can happen when the SANnav server encounters an Out Of Memory (OOM) condition. The vulnerability could allow an authenticated admin user with access to the server hosting the SANnav to potentially view the memory swap file and access the password(s).CVE-2026-5047broadcombrocade_sannav+113d ago08-10-2026 05:18

A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access the passwords.CVE-2026-5049broadcombrocade_sannav+113d ago08-10-2026 05:29

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory.CVE-2026-5048broadcombrocade_sannav+113d ago08-10-2026 05:23

In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters.CVE-2023-31423broadcombrocade_sannav+13y ago31-08-2023 00:43

Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav before v2.3.0 and 2.2.2a. Notes: To access the logs, the local attacker must have access to an already collected Brocade SANnav "supportsave" outputs.CVE-2023-31925broadcombrocade_sannav+13y ago31-08-2023 00:20

Brocade SANnav before v2.3.0 and v2.2.2a stores SNMPv3 Authentication passwords in plaintext. A privileged user could retrieve these credentials with knowledge and access to these log files. SNMP credentials could be seen in SANnav SupportSave if the capture is performed after an SNMP configuration failure causes an SNMP communication log dump.CVE-2023-31424broadcombrocade_sannav+13y ago31-08-2023 00:54

Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization.