Brocade Sannav (Broadcom) - vulnerabilities (CVEs)

58 CVEs, 4 in the last 30 days, 21 known versions, newest CVE from 2026-10-08. Vendor: Broadcom.

CVEs of Brocade Sannav

CVE-2026-5769 - CVSS 5.6 (medium), 2026-10-08: A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the…
CVE-2026-5049 - CVSS 6.9 (medium), 2026-10-08: A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an…
CVE-2026-5048 - CVSS 8 (high), 2026-10-08: In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker…
CVE-2026-5047 - CVSS 8.2 (high), 2026-10-08: A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could allow an…
CVE-2025-6392 - CVSS 6.7 (medium), 2025-07-10: Brocade SANnav before Brocade SANnav 2.4.0a could log database passwords in clear text in audit logs when the daily data dump collector invokes docker exec…
CVE-2025-6390 - CVSS 5.1 (medium), 2025-07-10: Brocade SANnav before SANnav 2.4.0a logs passwords and pbe keys in the Brocade SANnav server audit logs after installation and under specific conditions.…
CVE-2025-4662 - CVSS 5.1 (medium), 2025-07-10: Brocade SANnav before SANnav 2.4.0a logs plaintext passphrases in the Brocade SANnav host server audit logs while executing OpenSSL command using a passphrase…
CVE-2024-4282 - CVSS 9.8 (critical), 2025-02-15: Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22.
CVE-2024-10405 - CVSS 6.9 (medium), 2025-02-15: Brocade SANnav before SANnav 2.3.1b enables weak TLS ciphers on ports 443 and 18082. In case of a successful exploit, an attacker can read Brocade SANnav data…
CVE-2024-2240 - CVSS 8.6 (high), 2025-02-14: Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various…
CVE-2025-1053 - CVSS 8.6 (high), 2025-02-14: Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav…
CVE-2024-10404 - CVSS 5.5 (medium), 2025-02-14: CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker…
CVE-2022-43936 - CVSS 6.8 (medium), 2024-11-21: Brocade SANnav versions before 2.2.2 log Brocade Fabric OS switch passwords when debugging is enabled.
CVE-2022-43935 - CVSS 5.3 (medium), 2024-11-21: An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where Brocade Fabric OS Switch passwords and…
CVE-2022-43937 - CVSS 5.7 (medium), 2024-11-21: Possible information exposure through log file vulnerability where sensitive fields are recorded in the debug-enabled logs when debugging is turned on in…
CVE-2022-43934 - CVSS 7.5 (high), 2024-11-21: Brocade SANnav before Brocade SANnav 2.2.2 supports key exchange algorithms, which are considered weak on ports 24, 6514, 18023, 19094, and 19095.
CVE-2022-43933 - CVSS 4.4 (medium), 2024-11-21: An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are logged in…
CVE-2024-3596 - CVSS 9 (critical), 2024-07-09: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or…
CVE-2024-2860 - CVSS 7.8 (high), 2024-05-08: The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM…
CVE-2024-2859 - CVSS 7.2 (high), 2024-04-27: By default, SANnav OVA is shipped with root user login enabled. While protected by a password, access to root could expose SANnav to a remote attacker should…
CVE-2024-4173 - CVSS 9.8 (critical), 2024-04-25: A vulnerability in Brocade SANnav exposes Kafka in the wan interface. The vulnerability could allow an unauthenticated attacker to perform various attacks,…
CVE-2024-4161 - CVSS 8.6 (high), 2024-04-25: In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitive…
CVE-2024-4159 - CVSS 5.3 (medium), 2024-04-25: Brocade SANnav before v2.3.0a lacks protection mechanisms on port 2377/TCP and 7946/TCP, which could allow an unauthenticated attacker to sniff the SANnav…
CVE-2024-29969 - CVSS 7.5 (high), 2024-04-19: When a Brocade SANnav installation is upgraded from Brocade SANnav v2.2.2 to Brocade SANnav 2.3.0, TLS/SSL weak message authentication code ciphers are added…
CVE-2024-29968 - CVSS 7.7 (high), 2024-04-19: An information disclosure vulnerability exists in Brocade SANnav before v2.3.1 and v2.3.0a when Brocade SANnav instances are configured in disaster recovery…
CVE-2024-29966 - CVSS 9.8 (critical), 2024-04-19: Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The…
CVE-2024-29965 - CVSS 6.8 (medium), 2024-04-19: In Brocade SANnav before v2.3.1, and v2.3.0a, it is possible to back up the appliance from the web interface or the command line interface ("SSH"). The…
CVE-2024-29964 - CVSS 6.5 (medium), 2024-04-19: Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. An unprivileged attacker who gains access to the…
CVE-2024-29967 - CVSS 6 (medium), 2024-04-19: In Brocade SANnav before Brocade SANnav v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points, allowing…
CVE-2024-29962 - CVSS 5.5 (medium), 2024-04-19: Brocade SANnav OVA before v2.3.1 and v2.3.0a have an insecure file permission setting that makes files world-readable. This could allow a local user without…
CVE-2024-29960 - CVSS 7.5 (high), 2024-04-19: In Brocade SANnav server before v2.3.1 and v2.3.0a, the SSH keys inside the OVA image are identical in the VM every time SANnav is installed. Any Brocade…
CVE-2024-29959 - CVSS 8.6 (high), 2024-04-19: A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support…
CVE-2024-29963 - CVSS 3.8 (low), 2024-04-19: Brocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded TLS keys used by Docker. Note: Brocade SANnav doesn't have access to remote Docker registries.
CVE-2024-29961 - CVSS 8.2 (high), 2024-04-19: A vulnerability affects Brocade SANnav before v2.3.1 and v2.3.0a. It allows a Brocade SANnav service to send ping commands in the background at regular…
CVE-2024-29958 - CVSS 7.5 (high), 2024-04-19: A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints the encryption key in the console when a privileged user executes the script to replace the…
CVE-2024-29957 - CVSS 7.5 (high), 2024-04-19: When Brocade SANnav before v2.3.1 and v2.3.0a servers are configured in Disaster Recovery mode, the encryption key is stored in the DR log files. This could…
CVE-2024-29956 - CVSS 6.5 (medium), 2024-04-18: A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints the Brocade SANnav password in clear text in supportsave logs when a user schedules a…
CVE-2024-29955 - CVSS 5.5 (medium), 2024-04-17: A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allow a privileged user to print the SANnav encrypted key in PostgreSQL startup logs. This…
CVE-2024-29952 - CVSS 5.5 (medium), 2024-04-17: A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allow an authenticated user to print the Auth, Priv, and SSL key store passwords in…
CVE-2024-29951 - CVSS 5.7 (medium), 2024-04-17: Brocade SANnav before v2.3.1 and v2.3.0a uses the SHA-1 hash in internal SSH ports that are not open to remote connection.
CVE-2024-29950 - CVSS 7.5 (high), 2024-04-17: The class FileTransfer implemented in Brocade SANnav before v2.3.1, v2.3.0a, uses the ssh-rsa signature scheme, which has a SHA-1 hash. The vulnerability…
CVE-2023-31424 - CVSS 9.8 (critical), 2023-08-31: Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization.
CVE-2023-31925 - CVSS 6.5 (medium), 2023-08-31: Brocade SANnav before v2.3.0 and v2.2.2a stores SNMPv3 Authentication passwords in plaintext. A privileged user could retrieve these credentials with…
CVE-2023-31423 - CVSS 5.7 (medium), 2023-08-31: Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav…
CVE-2022-33187 - CVSS 5.5 (medium), 2022-12-09: Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to…
CVE-2022-23305 - CVSS 9.8 (critical), 2022-01-18: By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from…
CVE-2022-23302 - CVSS 8.8 (high), 2022-01-18: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if…
CVE-2020-15379 - CVSS 7.5 (high), 2021-06-09: Brocade SANnav before v.2.1.0a could allow remote attackers cause a denial-of-service condition due to a lack of proper validation, of the length of…
CVE-2020-15387 - CVSS 7.4 (high), 2021-06-09: The host SSH servers of Brocade Fabric OS before Brocade Fabric OS v7.4.2h, v8.2.1c, v8.2.2, v9.0.0, and Brocade SANnav before v2.1.1 utilize keys of less…
CVE-2020-15382 - CVSS 7.2 (high), 2021-06-09: Brocade SANnav before version 2.1.1 uses a hard-coded administrator account with the weak password ‘passw0rd’ if a password is not provided for PostgreSQL at…
CVE-2019-16212 - CVSS 8.8 (high), 2020-09-25: A vulnerability in Brocade SANnav versions before v2.1.0 could allow a remote authenticated attacker to conduct an LDAP injection. The vulnerability could…
CVE-2019-16211 - CVSS 9.8 (critical), 2020-09-25: Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability.
CVE-2019-16207 - CVSS 7.8 (high), 2019-11-08: Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database and gain…
CVE-2019-16210 - CVSS 5.5 (medium), 2019-11-08: Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save.
CVE-2019-16206 - CVSS 5.5 (medium), 2019-11-08: The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' logging level; which…
CVE-2019-16209 - CVSS 7.4 (high), 2019-11-08: A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to perform a man-in-the-middle attack…
CVE-2019-16205 - CVSS 8.8 (high), 2019-11-08: A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an…
CVE-2019-16208 - CVSS 7.5 (high), 2019-11-08: Password-based encryption (PBE) algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptographic keys that may allow an attacker…