CVE-2019-16205

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insufficiently random session ID for several post-authentication actions in the SANnav portal.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-330

Affected software

No affected versions have been published.

Timeline

Published: Nov 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-162065.5The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' logg CVE-2019-162077.8Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database CVE-2019-162087.5Password-based encryption (PBE) algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptographic keys that may CVE-2019-162097.4A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to perform a man-in-the-mi CVE-2019-16217.5A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote att CVE-2019-162105.5Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save.CVE-2019-162119.8Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability.CVE-2019-162128.8A vulnerability in Brocade SANnav versions before v2.1.0 could allow a remote authenticated attacker to conduct an LDAP injection. The vulne CVE-2019-162138.8Tenda PA6 Wi-Fi Powerline extender 1.0.1.21 could allow a remote authenticated attacker to execute arbitrary commands on the system. By send CVE-2019-162145.7Libra Core before 2019-09-03 has an erroneous regular expression for inline comments, which makes it easier for attackers to interfere with CVE-2019-162156.5The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into CVE-2019-162165.4Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files o