Filtered by vendor Broadcom Subscriptions
Total 600 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-3596 5 Broadcom, Freeradius, Ietf and 2 more 12 Brocade Sannav, Fabric Operating System, Freeradius and 9 more 2025-08-27 9 Critical
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.
CVE-2025-4662 1 Broadcom 1 Brocade Sannav 2025-08-27 4.4 Medium
Brocade SANnav before SANnav 2.4.0a logs plaintext passphrases in the Brocade SANnav host server audit logs while executing OpenSSL command using a passphrase from the command line or while providing the passphrase through a temporary file. These audit logs are the local server VM’s audit logs and are not controlled by SANnav. These logs are only visible to the server admin of the host server and are not visible to the SANnav admin or any SANnav user.
CVE-2025-6390 1 Broadcom 1 Brocade Sannav 2025-08-27 4.4 Medium
Brocade SANnav before SANnav 2.4.0a logs passwords and pbe keys in the Brocade SANnav server audit logs after installation and under specific conditions. These audit logs are the local server VM’s audit logs and are not controlled by SANnav. These logs are only visible to the server admin of the host server and are not visible to the SANnav admin or any SANnav user.
CVE-2025-6392 1 Broadcom 1 Brocade Sannav 2025-08-27 4.4 Medium
Brocade SANnav before Brocade SANnav 2.4.0a could log database passwords in clear text in audit logs when the daily data dump collector invokes docker exec commands. These audit logs are the local server VM’s audit logs and are not controlled by SANnav. These logs are only visible to the server admin of the host server and are not visible to the SANnav admin or any SANnav user.
CVE-2024-10404 1 Broadcom 1 Brocade Sannav 2025-08-26 5.5 Medium
CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker to view Brocade Fabric OS switch sensitive information in clear text. An attacker with administrative privileges could retrieve sensitive information including passwords; SNMP responses that contain AuthSecret and PrivSecret after collecting a “supportsave” or getting access to an already collected “supportsave”. NOTE: this issue exists because of an incomplete fix for CVE-2024-29952
CVE-2025-1053 1 Broadcom 1 Brocade Sannav 2025-08-26 4.9 Medium
Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave. An attacker with privileged access to the Brocade SANnav database could use the encryption key to obtain passwords used by Brocade SANnav.
CVE-2024-2240 2 Broadcom, Brocade 2 Brocade Sannav, Sannav 2025-08-26 7.2 High
Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various attacks.
CVE-2024-10405 2 Broadcom, Brocade 2 Brocade Sannav, Sannav 2025-08-26 5.3 Medium
Brocade SANnav before SANnav 2.3.1b enables weak TLS ciphers on ports 443 and 18082. In case of a successful exploit, an attacker can read Brocade SANnav data stream that includes monitored Brocade Fabric OS switches performance data, port status, zoning information, WWNs, IP Addresses, but no customer data, no personal data and no secrets or passwords, as it travels across the network.
CVE-2024-4282 2 Broadcom, Brocade 2 Brocade Sannav, Sannav 2025-08-26 9.8 Critical
Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22.
CVE-2025-3599 1 Broadcom 2 Symantec Endpoint Protection, Symantec Eraser Engine 2025-08-21 6.5 Medium
Symantec Endpoint Protection Windows Agent, running an ERASER Engine prior to 119.1.7.8, may be susceptible to an Elevation of Privilege vulnerability, which may allow an attacker to delete resources that are normally protected from an application or user.
CVE-2021-21981 1 Broadcom 1 Vmware Nsx-t Data Center 2025-08-13 7.8 High
VMware NSX-T contains a privilege escalation vulnerability due to an issue with RBAC (Role based access control) role assignment. Successful exploitation of this issue may allow attackers with local guest user account to assign privileges higher than their own permission level.
CVE-2020-3993 2 Broadcom, Vmware 2 Vmware Nsx-t Data Center, Cloud Foundation 2025-08-13 5.9 Medium
VMware NSX-T (3.x before 3.0.2, 2.5.x before 2.5.2.2.0) contains a security vulnerability that exists in the way it allows a KVM host to download and install packages from NSX manager. A malicious actor with MITM positioning may be able to exploit this issue to compromise the transport node.
CVE-2023-20868 1 Broadcom 1 Vmware Nsx-t Data Center 2025-08-13 6.1 Medium
NSX-T contains a reflected cross-site scripting vulnerability due to a lack of input validation. A remote attacker can inject HTML or JavaScript to redirect to malicious pages.
CVE-2025-8660 1 Broadcom 1 Symantec Pgp Encryption 2025-08-12 N/A
Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed.
CVE-2025-8661 1 Broadcom 1 Symantec Pgp Encryption 2025-08-12 N/A
A stored Cross-Site Scripting vulnerability (XSS) occurs when the server does not properly validate or encode the data entered by the user.
CVE-2025-50200 1 Broadcom 1 Rabbitmq Server 2025-08-06 5.5 Medium
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
CVE-2014-0160 13 Broadcom, Canonical, Debian and 10 more 37 Symantec Messaging Gateway, Ubuntu Linux, Debian Linux and 34 more 2025-07-30 7.5 High
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
CVE-2021-40438 11 Apache, Broadcom, Debian and 8 more 45 Http Server, Brocade Fabric Operating System Firmware, Debian Linux and 42 more 2025-07-30 9 Critical
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2024-38812 2 Broadcom, Vmware 3 Vmware Cloud Foundation, Vmware Vcenter Server, Vcenter Server 2025-07-30 9.8 Critical
The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
CVE-2024-38813 2 Broadcom, Vmware 3 Vmware Center Server, Vmware Cloud Foundation, Vcenter Server 2025-07-30 7.5 High
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.