Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

5,661 results · page 52 of 114

Aug 30, 2023In Brocade Fabric OS before v9.2.0a, a local authenticated privileged user can trigger a buffer overflow condition, leading to a kernel panic with large inpuCVE-2023-4163 · Other software · Brocade · reported by sirt@brocade.comMedium 4.4
In Brocade Fabric OS before v9.2.0a, a local authenticated privileged user can trigger a buffer overflow condition, leading to a kernel panic with large input to buffers in the portcfgfportbuffers command.
Product
Brocade Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 30, 2023A segmentation fault can occur in Brocade Fabric OS after Brocade Fabric OS v9.0 and before Brocade Fabric OS v9.2.0a through the passwdcfg command.CVE-2023-4162 · Other software · Brocade · reported by sirt@brocade.comMedium 4.4
A segmentation fault can occur in Brocade Fabric OS after Brocade Fabric OS v9.0 and before Brocade Fabric OS v9.2.0a through the passwdcfg command. This could allow an authenticated privileged user local user to crash a Brocade Fabric OS swith using the cli “passwdcfg --set -expire -minDiff“.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 30, 2023Brocade SANnav before v2.3.0 and v2.2.2a stores SNMPv3 Authentication passwords in plaintext.CVE-2023-31925 · Other software · Brocade · reported by sirt@brocade.comMedium 5.4
Brocade SANnav before v2.3.0 and v2.2.2a stores SNMPv3 Authentication passwords in plaintext. A privileged user could retrieve these credentials with knowledge and access to these log files. SNMP credentials could be seen in SANnav SupportSave if the capture is performed after an SNMP configuration failure causes an SNMP communication log dump.
Product
Brocade SANnav
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com support.broadcom.com
Aug 30, 2023Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization.CVE-2023-31424 · Other software · Brocade · reported by sirt@brocade.comHigh 8.1
Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization.
Product
SANnav
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 30, 2023Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav bCVE-2023-31423 · Other software · Brocade · reported by sirt@brocade.comMedium 5.7
Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav before v2.3.0 and 2.2.2a. Notes: To access the logs, the local attacker must have access to an already collected Brocade SANnav "supportsave" outputs.
Product
SANnav
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 30, 2023The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a dCVE-2023-3489 · Other software · Brocade · reported by sirt@brocade.comHigh 8.6
The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade from Fabric OS v9.2.0 to any earlier version of Fabric OS.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 20, 2023N.V.K.INTER CO., LTD.CVE-2023-39809 · Other software · Nvki · reported by MITRECritical 9.8
N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain an OS command injection vulnerability via shell metacharacters in the system_hostname parameter at /manage/network-basic.php.
Product
Intelligent Broadband Subscriber Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sec.maride.cc
Aug 20, 2023N.V.K.INTER CO., LTD.CVE-2023-39808 · Other software · Nvki · reported by MITRECritical 9.8
N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a hardcoded root password that allows attackers to login with root privileges via the SSH service. The cleartext password corresponding to the $1$4Tmm01jl$7HRvcW.bz7uGmX9hiQWvR hash was not determined by the vulnerability discoverer.
Product
Intelligent Broadband Subscriber Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sec.maride.cc
Aug 20, 2023N.V.K.INTER CO., LTD.CVE-2023-39807 · Other software · Nvki · reported by MITRECritical 9.8
N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a SQL injection vulnerability via the a_passwd parameter at /portal/user-register.php.
Product
Intelligent Broadband Subscriber Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sec.maride.cc
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connectionCVE-2023-4344 · Other software · Broadcom · reported by cret@cert.orgCritical 9.8
Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameterCVE-2023-4343 · Other software · Broadcom · reported by cret@cert.orgHigh 7.5
Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameter
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP strict-transport-security policyCVE-2023-4342 · Other software · Broadcom · reported by cret@cert.orgCritical 9.8
Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP strict-transport-security policy
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUICVE-2023-4341 · Other software · Broadcom · reported by cret@cert.orgCritical 9.8
Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUI
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller is vulnerable to Privilege escalation by taking advantage of the Session prints in the log fileCVE-2023-4340 · Other software · Broadcom · reported by cret@cert.orgCritical 9.8
Broadcom RAID Controller is vulnerable to Privilege escalation by taking advantage of the Session prints in the log file
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissionsCVE-2023-4339 · Other software · Broadcom · reported by cret@cert.orgHigh 7.5
Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options HeadersCVE-2023-4338 · Other software · Broadcom · reported by cret@cert.orgCritical 9.8
Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options Headers
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installationCVE-2023-4337 · Other software · Broadcom · reported by cret@cert.orgCritical 9.8
Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installation
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attributeCVE-2023-4336 · Other software · Broadcom · reported by cret@cert.orgCritical 9.8
Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attribute
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on LinuxCVE-2023-4335 · Other software · Broadcom · reported by cret@cert.orgHigh 7.5
Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller Web server (nginx) is serving private files without any authenticationCVE-2023-4334 · Other software · Broadcom · reported by cret@cert.orgHigh 7.5
Broadcom RAID Controller Web server (nginx) is serving private files without any authentication
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by serverCVE-2023-4333 · Other software · Broadcom · reported by cret@cert.orgMedium 5.5
Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log fileCVE-2023-4332 · Other software · Broadcom · reported by cret@cert.orgHigh 7.5
Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocolsCVE-2023-4331 · Other software · Broadcom · reported by cret@cert.orgHigh 7.5
Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocols
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribCVE-2023-4329 · Other software · Broadcom · reported by cret@cert.orgCritical 9.8
Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on WindowsCVE-2023-4328 · Other software · Broadcom · reported by cret@cert.orgMedium 5.5
Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Windows
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on LinuxCVE-2023-4327 · Other software · Broadcom · reported by cret@cert.orgMedium 5.5
Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuitesCVE-2023-4326 · Other software · Broadcom · reported by cret@cert.orgHigh 7.5
Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuites
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilitiesCVE-2023-4325 · Other software · Broadcom · reported by cret@cert.orgCritical 9.8
Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilities
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headersCVE-2023-4324 · Other software · Broadcom · reported by cret@cert.orgCritical 9.8
Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setupCVE-2023-4323 · Other software · Broadcom · reported by cret@cert.orgCritical 9.8
Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setup
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 15, 2023Use after free in Network in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has elicited a browser shutdown to potentially exploit heap corrCVE-2023-4351 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Network in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has elicited a browser shutdown to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com crbug.com
Aug 15, 2023Broadcom RAID Controller web interface is vulnerable client-side control bypass leads to unauthorized data access for low privileged userCVE-2023-4345 · Other software · Broadcom · reported by cret@cert.orgMedium 6.5
Broadcom RAID Controller web interface is vulnerable client-side control bypass leads to unauthorized data access for low privileged user
Product
LSI Storage Authority (LSA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record broadcom.com broadcom.com
Aug 14, 2023In setMediaButtonBroadcastReceiver of MediaSessionRecord.java, there is a possible permanent DoS due to resource exhaustion.CVE-2023-21280 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In setMediaButtonBroadcastReceiver of MediaSessionRecord.java, there is a possible permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Aug 14, 2023In onAccessPointChanged of AccessPointPreference.java, there is a possible way for unprivileged apps to receive a broadcast about WiFi access point change and iCVE-2023-21230 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In onAccessPointChanged of AccessPointPreference.java, there is a possible way for unprivileged apps to receive a broadcast about WiFi access point change and its BSSID or SSID due to a precondition check failure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Aug 11, 2023Buffer Overflow vulnerability in cFilenameInit parameter in browseForDoc function in Foxit Software Foxit PDF Reader version 10.1.0.37527, allows local attackerCVE-2020-35990 · Other software · Foxit · reported by MITREMedium 5.5
Buffer Overflow vulnerability in cFilenameInit parameter in browseForDoc function in Foxit Software Foxit PDF Reader version 10.1.0.37527, allows local attackers to cause a denial of service (DoS) via crafted .pdf file.
Product
PDF Reader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com foxitsoftware.com
Aug 9, 2023HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm.CVE-2023-23347 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.4
HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
Product
HCL DRYiCE iAutomate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Aug 9, 2023HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm.CVE-2023-23346 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.4
HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
Product
HCL DRYiCE MyCloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Aug 9, 2023In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the CVE-2023-24477 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comMedium 5.4
In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session.
Product
Guardian
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.nozominetworks.com security.nozominetworks.com
Aug 5, 2023A vulnerability was found in Media Browser Emby Server 4.7.13.0 and classified as problematic.CVE-2023-4167 · Other software · Media Browser · reported by VulDBLow 3.5
A vulnerability was found in Media Browser Emby Server 4.7.13.0 and classified as problematic. This issue affects some unknown processing of the file /web/. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-236183.
Product
Emby Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Aug 4, 2023Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the bCVE-2023-33379 · Other software · connectedio · reported by MITRECritical 9.8
Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the broker and issue commands to other device, impersonating Connected IO management platform and sending commands to all of Connected IO's devices.
Product
connected_io
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record claroty.com connectedio.com
Aug 3, 2023A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker to elevate privilegeCVE-2023-20216 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.4
A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker to elevate privileges to root on an affected system. This vulnerability is due to incorrect implementation of user role permissions. An attacker could exploit this vulnerability by authenticating to the application as a user with the BWORKS or BWSUPERADMIN role and issuing crafted commands on an affected system. A successful exploit could allow the attacker to execute commands beyond the sphere of their intended access level, including initiating installs or running operating system commands with elevated permissions. There are workarounds that address this vulnerability.
Product
Cisco BroadWorks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Aug 3, 2023A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to conducCVE-2023-20204 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Product
Cisco BroadWorks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Aug 3, 2023 A broken access control was found allowing for privileged escalation of the operator account to gain administrator privileges.CVE-2023-21407 · Other software · Axis Communications AB · reported by product-security@axis.comHigh 8.8
A broken access control was found allowing for privileged escalation of the operator account to gain administrator privileges.
Product
AXIS License Plate Verifier
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record axis.com axis.com
Aug 1, 2023An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated aCVE-2023-31927 · Other software · Brocade · reported by sirt@brocade.comMedium 5.3
An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated attacker to get technical details about the web interface.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0.CVE-2023-31926 · Other software · Brocade · reported by sirt@brocade.comHigh 7.1
System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023A reflected cross-site scripting (XSS) vulnerability exists in Brocade Webtools PortSetting.html of Brocade Fabric OS version before Brocade Fabric OS v9.2.0 tCVE-2023-31928 · Other software · Brocade · reported by sirt@brocade.comMedium 6.3
A reflected cross-site scripting (XSS) vulnerability exists in Brocade Webtools PortSetting.html of Brocade Fabric OS version before Brocade Fabric OS v9.2.0 that could allow a remote unauthenticated attacker to execute arbitrary JavaScript code in a target user’s session with the Brocade Webtools application.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain rootCVE-2023-31432 · Other software · Brocade · reported by sirt@brocade.comHigh 7.8
Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain root privileges in Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c and v9.2.0.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c could allow an authenticated user to crashCVE-2023-31431 · Other software · Brocade · reported by sirt@brocade.comMedium 5.5
A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c could allow an authenticated user to crash the Brocade Fabric OS switch leading to a denial of service.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0 could allow an authenticated priviCVE-2023-31430 · Other software · Brocade · reported by sirt@brocade.comMedium 5.5
A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0 could allow an authenticated privileged user to crash the Brocade Fabric OS switch leading to a denial of service.
Product
Brocade Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com
Aug 1, 2023Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dump files under user'sCVE-2023-31428 · Other software · Brocade · reported by sirt@brocade.comMedium 5.5
Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dump files under user's home directory using grep.
Product
Fabric OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com support.broadcom.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.