Vulnerabilities (CVE)

Filtered by vendor Broadcom Subscribe
Total 568 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-4197 5 Broadcom, Debian, Linux and 2 more 14 Brocade Fabric Operating System Firmware, Debian Linux, Linux Kernel and 11 more 2024-11-21 7.2 HIGH 7.8 HIGH
An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system.
CVE-2021-46825 1 Broadcom 2 Advanced Secure Gateway, Proxysg 2024-11-21 6.4 MEDIUM 9.1 CRITICAL
Symantec Advanced Secure Gateway (ASG) and ProxySG are susceptible to an HTTP desync vulnerability. When a remote unauthenticated attacker and other web clients communicate through the proxy with the same web server, the attacker can send crafted HTTP requests and cause the proxy to forward web server responses to unintended clients. Severity/CVSSv3: High / 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVE-2021-45387 1 Broadcom 1 Tcpreplay 2024-11-21 4.3 MEDIUM 5.5 MEDIUM
tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c.
CVE-2021-45386 1 Broadcom 1 Tcpreplay 2024-11-21 4.3 MEDIUM 5.5 MEDIUM
tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv6() at tree.c
CVE-2021-44050 2 Broadcom, Microsoft 4 Ca Network Flow Analysis, Windows Server 2012, Windows Server 2016 and 1 more 2024-11-21 4.0 MEDIUM 6.5 MEDIUM
CA Network Flow Analysis (NFA) 21.2.1 and earlier contain a SQL injection vulnerability in the NFA web application, due to insufficient input validation, that could potentially allow an authenticated user to access sensitive data.
CVE-2021-42775 1 Broadcom 1 Emulex Hba Manager 2024-11-21 6.4 MEDIUM 9.1 CRITICAL
Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a vulnerability in the remote firmware download feature that could allow a user to place or replace an arbitrary file on the remote host. In non-secure mode, the user is unauthenticated.
CVE-2021-42774 1 Broadcom 1 Emulex Hba Manager 2024-11-21 7.5 HIGH 9.8 CRITICAL
Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a buffer overflow vulnerability in the remote firmware download feature that could allow remote unauthenticated users to perform various attacks. In non-secure mode, the user is unauthenticated.
CVE-2021-42773 1 Broadcom 1 Emulex Hba Manager 2024-11-21 5.0 MEDIUM 7.5 HIGH
Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, could allow a user to retrieve an arbitrary file from a remote host with the GetDumpFile command. In non-secure mode, the user is unauthenticated.
CVE-2021-42772 1 Broadcom 2 Emulex Hba Manager, One Command Manager 2024-11-21 6.8 MEDIUM 9.8 CRITICAL
Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a buffer overflow vulnerability in the remote GetDumpFile command that could allow a user to attempt various attacks. In non-secure mode, the user is unauthenticated
CVE-2021-34798 8 Apache, Broadcom, Debian and 5 more 18 Http Server, Brocade Fabric Operating System Firmware, Debian Linux and 15 more 2024-11-21 5.0 MEDIUM 7.5 HIGH
Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-34174 1 Broadcom 4 Bcm4352, Bcm4352 Firmware, Bcm43684 and 1 more 2024-11-21 4.9 MEDIUM 4.6 MEDIUM
A vulnerability exists in Broadcom BCM4352 and BCM43684 chips. Any wireless router using BCM4352 and BCM43684 will be affected, such as ASUS AX6100. An attacker may cause a Denial of Service (DoS) to any device connected to BCM4352 or BCM43684 routers via an association or reassociation frame.
CVE-2021-31879 3 Broadcom, Gnu, Netapp 8 Brocade Fabric Operating System Firmware, Wget, 500f and 5 more 2024-11-21 5.8 MEDIUM 6.1 MEDIUM
GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.
CVE-2021-30651 1 Broadcom 1 Symantec Messaging Gateway 2024-11-21 4.0 MEDIUM 4.9 MEDIUM
A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that they might not otherwise be authorized to access.
CVE-2021-30650 1 Broadcom 1 Layer7 Api Management Oauth Toolkit 2024-11-21 4.3 MEDIUM 6.1 MEDIUM
A reflected cross-site scripting (XSS) vulnerability in the Symantec Layer7 API Management OAuth Toolkit (OTK) allows a remote attacker to craft a malicious URL for the OTK web UI and target OTK users with phishing attacks or other social engineering techniques. A successful attack allows injecting malicious code into the OTK web UI client application.
CVE-2021-30648 1 Broadcom 15 Symantec Advanced Secure Gateway 500-10, Symantec Advanced Secure Gateway 500-10 Firmware, Symantec Advanced Secure Gateway S200-30 and 12 more 2024-11-21 9.0 HIGH 9.8 CRITICAL
The Symantec Advanced Secure Gateway (ASG) and ProxySG web management consoles are susceptible to an authentication bypass vulnerability. An unauthenticated attacker can execute arbitrary CLI commands, view/modify the appliance configuration and policy, and shutdown/restart the appliance.
CVE-2021-28248 1 Broadcom 1 Ehealth 2024-11-21 5.0 MEDIUM 7.5 HIGH
CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. An attacker is able to perform an arbitrary number of /web/frames/ authentication attempts using different passwords, and eventually gain access to a targeted account, NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2021-28246 1 Broadcom 1 Ehealth 2024-11-21 4.4 MEDIUM 7.8 HIGH
CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regular user must create a malicious library in the writable RPATH, to be dynamically linked when the emtgtctl2 executable is run. The code in the library will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2021-28153 4 Broadcom, Debian, Fedoraproject and 1 more 4 Brocade Fabric Operating System Firmware, Debian Linux, Fedora and 1 more 2024-11-21 5.0 MEDIUM 5.3 MEDIUM
An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)
CVE-2021-27797 1 Broadcom 1 Fabric Operating System 2024-11-21 7.5 HIGH 9.8 CRITICAL
Brocade Fabric OS before Brocade Fabric OS v8.2.1c, v8.1.2h, and all versions of Brocade Fabric OS v8.0.x and v7.x contain documented hard-coded credentials, which could allow attackers to gain access to the system.
CVE-2021-27796 1 Broadcom 1 Fabric Operating System 2024-11-21 6.8 MEDIUM 6.5 MEDIUM
A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell environment (rbash) as either the “user” or “factory” account, to read the contents of any file on the filesystem utilizing one of a few available binaries.