Advisories · Technology
Brocade SANnav.
Every CVE that names Brocade SANnav among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.6 Medium
Brocade SANnav: A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch…
- Brocade SANnav
- CWE-313
- CVSS 6.9 Medium
Path traversal in Brocade SANnav
- Brocade SANnav
- Path traversal
- CVSS 6.1 Medium
SQL injection in Brocade SANnav
- Brocade SANnav
- SQL injection
- CVSS 8.2 High
Insecure storage of sensitive information in Brocade SANnav
- Brocade SANnav
- Information disclosure
- CVSS 6.4 Medium
Incomplete property masking in the SANnav logging subsystem
- Brocade SANnav
- Information disclosure
- CVSS 6.9 Medium
Logic flaw in SANnav Java cache key handling object comparison handling
- Brocade SANnav
- CWE-1025
- CVSS 6.9 Medium
Information exposure vulnerability in the job scheduling component of SANnav before 3.0.1a
- Brocade SANnav
- Information disclosure
- CVSS 8.4 High
Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav before 3.0.1a
- Brocade SANnav
- Information disclosure
- CVSS 8.5 High
Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav before 3.0.1.a
- Brocade SANnav
- Information disclosure
- CVSS 8.5 High
Plaintext exposure of sensitive authentication data in SANnav discovery service log files
- Brocade SANnav
- Information disclosure
- CVSS 8.6 High
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service
- Brocade SANnav
- Command injection
- CVSS 8.6 High
Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a
- Brocade SANnav
- Command injection
- CVSS 8.7 High
Improper access control in Brocade SANnav
- Brocade SANnav
- Broken access control
- CVSS 4.6 Medium
SQL queries with sensitive information printed in logs with Brocade SANnav before 3.0
- Brocade SANnav
- Information disclosure
- CVSS 7.1 High
Plain password is generated in the audit logs while executing update-reports-purge-settings.sh script with Brocade SANnav before 2.4.0a
- Brocade SANnav
- Information disclosure
- CVSS 8.5 High
Plaintext Switch admin login password is seen in Brocade SANnav support save
- Brocade SANnav
- Information disclosure
- CVSS 7.1 High
Plain text pbe key visible in audit log during Brocade SANnav migration from 2.4.0a to 3.0.0
- Brocade SANnav
- Information disclosure
- CVSS 6.0 Medium
Brocade SANnav DataBase plaintext password is logged in failover logs (CVE-2025-12680)
- Brocade SANnav
- Information disclosure
- CWE-256
- CVSS 8.2 High
Weak TLS Ciphers on Brocade SANnav OVA SSH port 22
- Brocade SANnav
- Weak cryptography or TLS
- CVSS 6.9 Medium
Weak TLS Ciphers on Brocade SANnav port 443 & 18082
- Brocade SANnav
- Weak cryptography or TLS
- CVSS 8.6 High
Docker implementation in Brocade SANnav is missing Audit Rules.
- Brocade SANnav
- Privilege escalation
- CVSS 8.6 High
Brocade SANnav encryption key is logged in the debug logs
- Brocade SANnav
- Information disclosure
- CVSS 5.5 Medium
Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsave
- Brocade SANnav
- Information disclosure
- CVSS 5.7 Medium
Brocade SANnav Information Disclosure Vulnerability
- Brocade SANnav
- Information disclosure
- CVSS 6.8 Medium
Brocade Fabric OS switch passwords when debugging is enabled
- Brocade SANnav
- Information disclosure
- CVSS 5.3 Medium
Switch passwords and authorization IDs are printed in the embedded MLS DB file
- Brocade SANnav
- Information disclosure
- CVSS 6.5 Medium
Weak Key-exchange algorithms
- Brocade SANnav
- Weak cryptography or TLS
- CVSS 4.4 Medium
configuration secrets are logged in support-save
- Brocade SANnav
- Information disclosure
- CVSS 7.8 High
Missing authentication in Brocade SAnnav
- Brocade SAnnav
- Authentication bypass
- CVSS 6.8 Medium
By default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859)
- Brocade SANnav
- Broken access control
- CVSS 7.6 High
SANnav versions exposes Kafka in the wan interface.
- Brocade SANnav
- Information disclosure
- CVSS 8.6 High
Syslog traffic sent in clear-text
- Brocade SANnav
- Weak cryptography or TLS
- CVSS 4.3 Medium
Protection mechanisms
- Brocade SANnav
- Information disclosure
- CVSS 7.5 High
TLS/SSL weak message authentication code ciphers are added by default for port 18082
- Brocade SANnav
- Weak cryptography or TLS
- CVSS 7.7 High
SQL Table names, column names, and SQL queries are collected in DR standby Supportsave
- Brocade SANnav
- Information disclosure
- CVSS 4.4 Medium
In Brocade SANnav before v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points
- Brocade SANnav
- Broken access control
- CVSS 7.5 High
hard-coded credentials in the documentation that appear as the appliance root password
- Brocade SANnav
- Hard-coded credentials
- CVSS 6.8 Medium
Insecure backup
- Brocade SANnav
- Information disclosure
- CVSS 5.7 Medium
Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files
- Brocade SANnav
- Broken access control
- CVSS 5.5 Medium
Insecure file permission setting that makes files world-readable
- Brocade SANnav
- Broken access control
- CVSS 1.9 Low
Brocade SANnav contains hardcoded TLS keys used by Docker
- Brocade SANnav
- Hard-coded credentials
- CVSS 8.2 High
supply-chain attack risk
- Brocade SANnav
- Information disclosure
- CVSS 6.8 Medium
Identical SSH keys utilized inside the OVA image (CVE-2024-29960)
- Brocade SANnav
- Hard-coded credentials
- CVSS 8.6 High
Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support save
- Brocade SANnav
- Information disclosure
- CVSS 7.5 High
Encryption key in the console when a privileged user executes the script to replace the Brocade SANnav Management Portal standby node.
- Brocade SANnav
- Information disclosure
- CVSS 7.5 High
Encryption key is stored in the DR log files
- Brocade SANnav
- Information disclosure
- CVSS 6.5 Medium
cleartext password in supportsave logs when a user schedules a switch Supportsave from Brocade SANnav
- Brocade SANnav
- Information disclosure
- CVSS 5.0 Medium
Insertion of Sensitive Information into Brocade SANnav Log File
- Brocade SANnav
- Information disclosure
- CVSS 5.5 Medium
Clear text storage of sensistive information by manipulating command variables
- Brocade SANnav
- Information disclosure
- CVSS 5.7 Medium
Brocade SANnav has weak encryption in internal SSH ports
- Brocade SANnav
- Weak cryptography or TLS
- CVSS 7.5 High
Brocade SANnav before v2.3.1, v2.3.0a uses weak encryption
- Brocade SANnav
- Weak cryptography or TLS
- CVSS 8.1 High
Web authentication and authorization bypass
- Brocade SANnav
- Authentication bypass
- CVSS 5.7 Medium
Possible information exposure through log file vulnerability
- Brocade SANnav
- Information disclosure
- CVSS 5.4 Medium
Storage of clear text password in Brocade SANnav
- Brocade SANnav
- Information disclosure
- CVSS 5.5 Medium
Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs
- Brocade SANnav
- Information disclosure
-
Brocade SANnav: In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8…
- Brocade SANnav
-
Brocade SANnav before Brocade SANvav v.
- Brocade SANnav
-
Brocade SANnav: In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8…
- Brocade SANnav
-
Brocade SANNav: An information exposure through log file vulnerability in Brocade SANNav versions before…
- Brocade SANNav
-
Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text.
- Brocade SANNav