rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-15297 
Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to 6.6.20.294 allows an unprivileged attacker to bypass the in-place mitigations and interact with hosts on the network. This issue affects: Bitdefender Update Server versions prior to 6.6.20.294.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Bitdefender
product: Bitdefender Update Server
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2020-11-09T08:25:15.214Z
CVE-2020-15299 
A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base64-encoded JavaScript (in the kc-online-preset-data POST parameter) that is executed in the victim's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-09T18:13:45.000Z
CVE-2020-15300 
SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-18T21:06:19.000Z
CVE-2020-15301 
SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. These fields are mishandled during a Download Import File Template operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-18T21:00:24.000Z
CVE-2020-15302 
In Argent RecoveryManager before 0xdc350d09f71c48c5D22fBE2741e4d6A03970E192, the executeRecovery function does not require any signatures in the zero-guardian case, which allows attackers to cause a denial of service (locking) or a takeover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-25T19:58:07.000Z
CVE-2020-15303 
Infoblox NIOS before 8.5.2 allows entity expansion during an XML upload operation, a related issue to CVE-2003-1564.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-28T12:45:09.000Z
CVE-2020-15304 
An issue was discovered in OpenEXR before 2.5.2. An invalid tiled input file could cause invalid memory access in TiledInputFile::TiledInputFile() in IlmImf/ImfTiledInputFile.cpp, as demonstrated by a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T00:38:18.000Z
CVE-2020-15305 
An issue was discovered in OpenEXR before 2.5.2. Invalid input could cause a use-after-free in DeepScanLineInputFile::DeepScanLineInputFile() in IlmImf/ImfDeepScanLineInputFile.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T00:38:11.000Z
CVE-2020-15306 
An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T00:38:02.000Z
CVE-2020-15307 
Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to create a custom field with a crafted field name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-30T17:50:02.000Z
CVE-2020-15308 
Support Incident Tracker (aka SiT! or SiTracker) 3.67 p2 allows post-authentication SQL injection via the site_edit.php typeid or site parameter, the search_incidents_advanced.php search_title parameter, or the report_qbe.php criteriafield parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T10:15:11.000Z
CVE-2020-15309 
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Local attackers can conduct a cache-timing attack against public key operations. These attackers may already have obtained sensitive information if the affected system has been used for private key operations (e.g., signing with a private key).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-21T13:16:49.000Z
CVE-2020-15312 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T14:59:20.000Z
CVE-2020-15313 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T15:01:16.000Z
CVE-2020-15314 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T15:02:02.000Z
CVE-2020-15315 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/axess chroot directory tree.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T15:08:09.000Z
CVE-2020-15316 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account within the /opt/axess chroot directory tree.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T15:08:59.000Z
CVE-2020-15317 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/axess chroot directory tree.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T15:10:30.000Z
CVE-2020-15318 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/mysql chroot directory tree.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T15:12:23.000Z
CVE-2020-15319 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/mysql chroot directory tree.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T15:14:03.000Z
CVE-2020-15320 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axiros password for the root account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T15:16:45.000Z
CVE-2020-15321 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axzyxel password for the livedbuser account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T15:20:18.000Z
CVE-2020-15322 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the wbboEZ4BN3ssxAfM hardcoded password for the debian-sys-maint account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T15:23:44.000Z
CVE-2020-15323 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the cloud1234 password for the a1@chopin account default credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T15:26:46.000Z
CVE-2020-15324 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a world-readable axess/opt/axXMPPHandler/config/xmpp_config.py file that stores hardcoded credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T15:29:41.000Z
CVE-2020-15325 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded Erlang cookie for ejabberd replication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:50:02.000Z
CVE-2020-15326 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded certificate for Ejabberd in ejabberd.pem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:48:31.000Z
CVE-2020-15327 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:47:18.000Z
CVE-2020-15328 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:46:24.000Z
CVE-2020-15329 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak Data.fs permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:45:12.000Z
CVE-2020-15330 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded APP_KEY in /opt/axess/etc/default/axess.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:41:49.000Z
CVE-2020-15331 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded OAUTH_SECRET_KEY in /opt/axess/etc/default/axess.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:39:40.000Z
CVE-2020-15332 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/etc/default/axess permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T15:04:59.000Z
CVE-2020-15333 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows attackers to discover accounts via MySQL "select * from Administrator_users" and "select * from Users_users" requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T15:04:22.000Z
CVE-2020-15334 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows escape-sequence injection into the /var/log/axxmpp.log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T15:02:57.000Z
CVE-2020-15335 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /registerCpe requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T15:02:11.000Z
CVE-2020-15336 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /cnr requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T15:01:28.000Z
CVE-2020-15337 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T15:00:44.000Z
CVE-2020-15338 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T15:00:03.000Z
CVE-2020-15339 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows live/CPEManager/AXCampaignManager/handle_campaign_script_link?script_name= XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:58:50.000Z
CVE-2020-15340 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/default_axess/axess/TR69/Handlers/turbolink/sshkeys/id_rsa SSH key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:58:09.000Z
CVE-2020-15341 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated update_all_realm_license API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:57:15.000Z
CVE-2020-15342 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:56:26.000Z
CVE-2020-15343 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user_key API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:55:30.000Z
CVE-2020-15344 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_user_id_and_key API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:54:27.000Z
CVE-2020-15345 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_instances_for_update API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:53:50.000Z
CVE-2020-15346 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a /live/GLOBALS API with the CLOUDCNM key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:53:12.000Z
CVE-2020-15347 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the q6xV4aW8bQ4cfD-b password for the axiros account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T14:51:48.000Z
CVE-2020-15348 
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/delete_cpes_by_ids?cpe_ids= for eval injection of Python code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T13:46:10.000Z
CVE-2020-15349 
BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vulnerability because the privileged helper tool implements an XPC interface that allows file operations to any process (copy, move, delete) as root and changing permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-17T01:56:05.000Z
CVE-2020-15350 
RIOT 2020.04 has a buffer overflow in the base64 decoder. The decoding function base64_decode() uses an output buffer estimation function to compute the required buffer capacity and validate against the provided buffer size. The base64_estimate_decode_size() function calculates the expected decoded size with an arithmetic round-off error and does not take into account possible padding bytes. Due to this underestimation, it may be possible to craft base64 input that causes a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-07T16:37:39.000Z
CVE-2020-15351 
IDrive before 6.7.3.19 on Windows installs by default to %PROGRAMFILES(X86)%\IDriveWindows with weak folder permissions granting any user modify permission (i.e., NT AUTHORITY\Authenticated Users:(OI)(CI)(M)) to the contents of the directory and its sub-folders. In addition, the program installs a service called IDriveService that runs as LocalSystem. Thus, any standard user can escalate privileges to NT AUTHORITY\SYSTEM by substituting the service's binary with a malicious one.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-26T18:35:26.000Z
CVE-2020-15352 
An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-27T04:10:54.000Z
CVE-2020-15357 
Network Analysis functionality in Askey AP5100W_Dual_SIG_1.01.097 and all prior versions allows remote attackers to execute arbitrary commands via a shell metacharacter in the ping, traceroute, or route options.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-11T15:22:13.000Z
CVE-2020-15358 
In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-27T11:39:37.000Z
CVE-2020-15360 
com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege escalation because of a lack of client verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-27T12:07:25.000Z
CVE-2020-15362 
wifiscanner.js in thingsSDK WiFi Scanner 1.0.1 allows Code Injection because it can be used with options to overwrite the default executable/binary path and its arguments. An attacker can abuse this functionality to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T16:12:44.000Z
CVE-2020-15363 
The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-28T11:48:06.000Z
CVE-2020-15364 
The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-28T11:47:57.000Z
CVE-2020-15365 
LibRaw before 0.20-Beta3 has an out-of-bounds write in parse_exif() in metadata\exif_gps.cpp via an unrecognized AtomName and a zero value of tiff_nifds.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-28T12:07:34.000Z
CVE-2020-15366 
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-15T19:14:07.000Z
CVE-2020-15367 
Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-07T14:00:15.000Z
CVE-2020-15368 
AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering a triple fault via a request to zero CR3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-29T00:00:00.000Z
CVE-2020-15369 
Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password field, which could expose users’ credentials of the remote server. An authenticated user could obtain the exposed password credentials to gain access to the remote host.
Problem types: description: Unprotected Storage of Credentials
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2020-09-25T13:08:45.000Z
CVE-2020-15370 
Brocade Fabric OS versions before Brocade Fabric OS v7.4.2g could allow an authenticated, remote attacker to view a user password in cleartext. The vulnerability is due to incorrectly logging the user password in log files.
Problem types: description: Unprotected Storage of Credentials
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2020-09-25T13:09:32.000Z
CVE-2020-15371 
Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, contains code injection and privilege escalation vulnerability.
Problem types: description: privilege escalation
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2020-09-25T13:10:23.000Z
CVE-2020-15372 
A vulnerability in the command-line interface in Brocade Fabric OS before Brocade Fabric OS v8.2.2a1, 8.2.2c, v7.4.2g, v8.2.0_CBN3, v8.2.1e, v8.1.2k, v9.0.0, could allow a local authenticated attacker to modify shell variables, which may lead to an escalation of privileges or bypassing the logging.
Problem types: description: privilege escalation
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2020-09-25T13:10:40.000Z
CVE-2020-15373 
Multiple buffer overflow vulnerabilities in REST API in Brocade Fabric OS versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c could allow remote unauthenticated attackers to perform various attacks.
Problem types: description: Buffer overflow
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2020-09-25T13:10:49.000Z
CVE-2020-15374 
Rest API in Brocade Fabric OS v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c is vulnerable to multiple instances of reflected input.
Problem types: description: Reflected Input
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2020-09-25T13:11:22.000Z
CVE-2020-15375 
Brocade Fabric OS versions before v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, v7.4.2g contain an improper input validation weakness in the command line interface when secccrypptocfg is invoked. The vulnerability could allow a local authenticated user to run arbitrary commands and perform escalation of privileges.
Problem types: description: Privilege escalation
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2020-12-11T20:34:43.000Z
CVE-2020-15376 
Brocade Fabric OS versions before v9.0.0 and after version v8.1.0, configured in Virtual Fabric mode contain a weakness in the ldap implementation that could allow a remote ldap user to login in the Brocade Fibre Channel SAN switch with "user" privileges if it is not associated with any groups.
Problem types: description: ldap authentication
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2020-12-11T20:34:24.000Z
CVE-2020-15377 
Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to a misconfiguration; this is commonly referred to as Server-Side Request Forgery (SSRF).
Problem types: description: Server-Side Request Forgery (SSRF)
Affected products: vendor: n/a
product: Brocade SANnav
Published: 2021-06-09T15:15:05.000Z
CVE-2020-15378 
The OVA version of Brocade SANnav before version 2.1.1 installation with IPv6 networking exposes the docker container ports to the network, increasing the potential attack surface.
Problem types: description: Open ports
Affected products: vendor: n/a
product: Brocade SANnav
Published: 2021-06-09T15:15:11.000Z
CVE-2020-15379 
Brocade SANnav before v.2.1.0a could allow remote attackers cause a denial-of-service condition due to a lack of proper validation, of the length of user-supplied data as name for custom field name.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Brocade SANnav
Published: 2021-06-09T15:15:19.000Z
CVE-2020-15380 
Brocade SANnav before version 2.1.1 logs account credentials at the ‘trace’ logging level.
Problem types: description: Insertion of Sensitive Information into Log File
Affected products: vendor: n/a
product: Brocade SANnav
Published: 2021-06-09T15:15:27.000Z
CVE-2020-15381 
Brocade SANnav before version 2.1.1 contains an Improper Authentication vulnerability that allows cleartext transmission of authentication credentials of the jmx server.
Problem types: description: Improper Authentication
Affected products: vendor: n/a
product: Brocade SANnav
Published: 2021-06-09T14:32:17.000Z
CVE-2020-15382 
Brocade SANnav before version 2.1.1 uses a hard-coded administrator account with the weak password ‘passw0rd’ if a password is not provided for PostgreSQL at install-time.
Problem types: description: Hard-coding credentials
Affected products: vendor: n/a
product: Brocade SANnav
Published: 2021-06-09T14:32:23.000Z
CVE-2020-15383 
Running security scans against the SAN switch can cause config and secnotify processes within the firmware before Brocade Fabric OS v9.0.0, v8.2.2d and v8.2.1e to consume all memory leading to denial of service impacts possibly including a switch panic.
Problem types: description: Denail of Service
Affected products: vendor: n/a
product: Brocade Fabric OS
Published: 2021-06-09T14:32:31.000Z