CVE Vulnerability Catalog

In Brocade ASCG before v3.0, several security-related HTTP headers were missing in various URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more.

An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS before 10.0.1. An authenticated user with USB management privileges can manipulate target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.

A logic vulnerability in Brocade Fabric OS before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for the active session context, allowing access to restricted configuration settings intended exclusively for administrative roles.

An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. User-supplied certificate identifiers are handled without adequate sanitization prior to execution in external system routines. An authenticated attacker with privileges to perform certificate deletion requests can execute arbitrary system commands with the privileges of the underlying management daemon. Affects versions before 9.2.2d and 10.0.0 through 10.0.0a1.

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file path parameter. An authenticated administrative user can submit a crafted status file parameter, causing the underlying process to move an arbitrary system file to a predictable, world-readable temporary directory. This can lead to persistent DoS, critical system file destruction, host compromise, or sensitive data leakage.

An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon relays configuration parameters, user-supplied relay host strings, and filenames directly to an internal utility script without sufficient character set validation. Because the local utility fails to sanitize shell metacharacters, a malicious or compromised configuration file can cause arbitrary OS commands to be executed on a remote local switch when an administrator initiates a configuration download.

An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When executing configuration viewing commands with search pattern filters, the utility fails to sanitize user-supplied search string options before passing them to internal search commands. An authenticated user with low-privilege administrative access can exploit this vulnerability to read arbitrary files on the local operating system, including sensitive configuration files, system password hashes and system secrets.

containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers.

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository information belonging to another organization. The same unscoped lookup is used by the mirror action, which may allow creating a repository in a product the user can edit that is configured with another organization's flatpak remote URL and stored remote credentials.

A flaw was found in Katello where the Docker Tags repositories API does not properly enforce organization scoping when listing repositories for a Docker meta tag. An authenticated user with permission to view products in one organization may be able to retrieve repository metadata associated with Docker tags belonging to another organization by supplying the tag identifier. This can result in unauthorized disclosure of repository configuration information across organization boundaries.

The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the application.

An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socket transport layer source IP address. Successful exploitation allows the attacker to bypass IP-filtering access control lists (ACLs) and obtain sensitive device metadata (such as model, serial number, hardware revision, and firmware version) without authentication.

Vulnerability in the Brocade Fabric OS management interface before version 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the IdP issuer parameter, allowing an administrator or attacker to inject arbitrary web server directives. This can lead to denial of service or alteration of web server security controls.

Stack-based buffer overflow in the security library component of Brocade Fabric OS before version 10.0.1. When parsing uploaded X.509 PEM certificates, the system improperly validates the AKI extension length before copying data. An authenticated administrator can supply a certificate with an oversized AKI extension, leading to memory corruption and management daemon crash.

Information disclosure vulnerability in SupportLink diagnostic utilities in Brocade Fabric OS before version 10.0.1. When SupportLink is configured with an authenticated HTTP proxy, the system stores the full proxy URL. Individuals with access to diagnostic bundles can extract cleartext proxy credentials.

Authorization logic vulnerability in the REST API gateway of Brocade Fabric OS before version 10.0.1. The internal gate for restricted management endpoints relies solely on client-controlled HTTP headers. An authenticated user can spoof these headers to gain unauthorized access to internal management endpoints, including hardware data and audit logs.

Missing authorization check in the REST API interface of Brocade Fabric OS before version 10.0.1. An authenticated user, regardless of role, can retrieve complete MAPS violation data across all logical switches. An attacker with low privileges can access system health, port performance, and configuration data.

Stack-based buffer overflow in the diagnostic execution utility of Brocade Fabric OS before version 10.0.1. When processing command arguments, the utility tokenizes input without enforcing array boundary checks. An authenticated administrator can supply excessive arguments, leading to memory overwrite and process crash.

Out-of-bounds write vulnerability in the RTCS UDP recvfrom() implementation in NXP MQX Classic before version 5.0. Improper enforcement of the receive buffer length may allow a crafted UDP packet to overflow the buffer, leading to memory corruption or denial of service.

An access control bypass vulnerability exists in the RBAC validation engine of Brocade Fabric OS before 10.0.1. The RBAC engine incorrectly categorizes non-standard action opcodes during permission checks, allowing authenticated read-only users to execute restricted administrative operations.