CVE Vulnerability Catalog

An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine, and malformed account names can cause the execution of embedded shell metacharacters.

A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication (IPC) storage callbacks, the service accepts and registers session structures including administrative role permissions, user identifiers, and authorization flags—without verifying the identity or authenticity of the sending process. An attacker can obtain elevated administrative privileges on the web management interface without legitimate authentication.

An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames, the receiving switch processes them at an elevated level without proper verification. An attacker on a single fabric-connected switch can escalate privileges and execute arbitrary root commands locally or across other managed fabric members.

In Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1, handling of specific download protocols uses unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed via a shell. Because control characters and shell metacharacters are not stripped, an attacker can execute arbitrary shell commands with the firmware management daemon's elevated privileges.

Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure can prevent the web management service from starting or recovering, leading to a persistent Denial of Service (DoS).

The Super Forms plugin for WordPress up to version 6.3.316 contains an arbitrary directory deletion vulnerability. This is due to insufficient validation of attacker-controlled JSON fields and an ineffective ABSPATH guard that can be easily bypassed. An unauthenticated attacker can recursively delete arbitrary directories on the server, including the WordPress root directory, provided the administrator has enabled the 'Delete files from server after form submissions' setting.

The Super Forms – Drag & Drop Form Builder plugin for WordPress up to version 6.3.316 is vulnerable to Unrestricted File Type Upload via the upload_files function. Missing file type validation allows authenticated attackers with Subscriber-level access and above to upload executable files, leading to remote code execution. The attack requires poisoning _super_elements post meta via the super_save_form AJAX handler, which lacks capability and nonce checks, and then uploading via super_upload_files without authentication.

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. updateSmartList sets creatorId to the caller identity and can set visibility to PRIVATE, locking out the original owner.

linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, allowing an unauthenticated attacker to force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.

An Improper Input Validation vulnerability in Brocade ASCG before v3.0 affects registered case credentials. A local authenticated user can provide invalid inputs like special characters, leading to a Denial of Service (DoS) when collecting 'supportsave' from a Brocade Switch.

In Brocade ASCG before v3.0, several security-related HTTP headers were missing in various URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more.

A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, the race condition causes PAM modules to process stale or incorrect client IP addresses and switch context numbers. This leads to inaccurate audit records and potential access control bypasses where AAA evaluation or Calling-Station-ID ACL policies rely on client IP attributes.

An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS before 10.0.1. An authenticated user with USB management privileges can manipulate target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.

A logic vulnerability in Brocade Fabric OS before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for the active session context, allowing access to restricted configuration settings intended exclusively for administrative roles.

An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. User-supplied certificate identifiers are handled without adequate sanitization prior to execution in external system routines. An authenticated attacker with privileges to perform certificate deletion requests can execute arbitrary system commands with the privileges of the underlying management daemon. Affects versions before 9.2.2d and 10.0.0 through 10.0.0a1.

An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this by submitting a crafted request with an arbitrary fabric identifier. This allows unauthorized cross-fabric operations and viewing configuration details within tenants/Virtual Fabrics to which they have not been granted access.

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file path parameter. An authenticated administrative user can submit a crafted status file parameter, causing the underlying process to move an arbitrary system file to a predictable, world-readable temporary directory. This can lead to persistent DoS, critical system file destruction, host compromise, or sensitive data leakage.

An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon relays configuration parameters, user-supplied relay host strings, and filenames directly to an internal utility script without sufficient character set validation. Because the local utility fails to sanitize shell metacharacters, a malicious or compromised configuration file can cause arbitrary OS commands to be executed on a remote local switch when an administrator initiates a configuration download.

A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal IPC channels allow an unprivileged local user to submit malformed logging configurations. Due to improper input sanitization during configuration file generation, an attacker can inject arbitrary directives that execute with elevated privileges when the logging service reloads, leading to local privilege escalation.

An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A privileged user with maintenance account access can exploit this by supplying crafted parameters, resulting in arbitrary OS command execution with root privileges.