Broadcom LSI Storage Authority (Lsa) vulnerabilities
22 vulnerabilities
Known vulnerabilities in Broadcom LSI Storage Authority (Lsa), newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2023-4326broadcomlsi storage authority (lsa)+2
EPSS score0.40%
Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuitesCVE-2023-4340broadcomlsi storage authority (lsa)+2EPSS score0.70%
Broadcom RAID Controller is vulnerable to Privilege escalation by taking advantage of the Session prints in the log fileCVE-2023-4336broadcomlsi storage authority (lsa)+2EPSS score0.70%
Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attributeCVE-2023-4333broadcomlsi storage authority (lsa)+1EPSS score0.12%
Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by serverCVE-2023-4337broadcomlsi storage authority (lsa)+2EPSS score0.70%
Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installationCVE-2023-4335broadcomlsi storage authority (lsa)+2EPSS score0.59%
Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on LinuxCVE-2023-4339broadcomlsi storage authority (lsa)+2EPSS score0.83%
Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissionsCVE-2023-4343broadcomlsi storage authority (lsa)+2EPSS score0.57%
Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameterCVE-2023-4345broadcomlsi storage authority (lsa)+2EPSS score0.58%
Broadcom RAID Controller web interface is vulnerable client-side control bypass leads to unauthorized data access for low privileged userCVE-2023-4334broadcomlsi storage authority (lsa)+2EPSS score0.60%
Broadcom RAID Controller Web server (nginx) is serving private files without any authenticationCVE-2023-4332broadcomlsi storage authority (lsa)+2EPSS score0.59%
Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log fileCVE-2023-4341broadcomlsi storage authority (lsa)+2EPSS score0.70%
Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUICVE-2023-4327broadcomlsi storage authority (lsa)+1EPSS score0.11%
Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on LinuxCVE-2023-4344broadcomlsi storage authority (lsa)+2EPSS score0.70%
Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connectionCVE-2023-4328broadcomlsi storage authority (lsa)+1EPSS score0.11%
Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on WindowsCVE-2023-4324broadcomlsi storage authority (lsa)+2EPSS score0.70%
Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headersCVE-2023-4323broadcomlsi storage authority (lsa)+2EPSS score0.70%
Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setupCVE-2023-4342broadcomlsi storage authority (lsa)+2EPSS score0.70%
Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP strict-transport-security policyCVE-2023-4338broadcomlsi storage authority (lsa)+2EPSS score0.70%
Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options HeadersCVE-2023-4331broadcomlsi storage authority (lsa)+2EPSS score0.35%
Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocols