CVE-2023-20858

CVE-2023-20858 affects VMware Carbon Black App Control management servers in versions 8.7.x before 8.7.8, 8.8.x before 8.8.6, and 8.9.x before 8.9.4. The issue is described as an injection vulnerability where a user with privileged access to the App Control administration console can supply speci...

PT-2023-1435

Name of the Vulnerable Software and Affected Versions VMware Carbon Black App Control versions 8.7.x through 8.7.7 VMware Carbon Black App Control versions 8.8.x through 8.8.5 VMware Carbon Black App Control versions 8.9.x prior to 8.9.4 Description The issue is related to an injection...

PT-2023-1450

Name of the Vulnerable Software and Affected Versions VMware vRealize Orchestrator affected versions not specified Description The issue is related to an XML External Entity XXE vulnerability. A malicious actor with non-administrative access to vRealize Orchestrator may be able to use specially...

This Week in Spring - February 21, 20223

Hi, Spring fans! Welcome to another installment of This Week in Spring! How're you? I almost forgot today was Tuesday! Here in the US, we had a three day weekend for President's day, and also I've been streaming for a few hours every day or almost every day on my little YouTube channel so the day...

CVE-2023-20858

VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying...

CVE-2023-20855

CVE-2023-20855 is an XXE vulnerability in VMware vRealize Orchestrator (affecting vRealize Orchestrator and related products such as vRealize Automation and Cloud Foundation). The root cause is an XML External Entity processing issue that allows a non-administrative user to craft input bypassing ...

VMSA-2023-0005:VMware vRealize Orchestrator update addresses an XML External Entity (XXE) vulnerability

Advisory ID: VMSA-2023-0005 CVSSv3 Range: 8.8 Issue Date:2023-02-21 Updated On: 2023-02-21 Initial Advisory CVEs: CVE-2023-20855 Synopsis: VMware vRealize Orchestrator update addresses an XML External Entity XXE vulnerability CVE-2023-20855 RSS Feed Download PDF Download Text File Share this page...

CVE-2022-37935

HPE OneView for VMware vCenter, in certain circumstances, may disclose the “HPE OneView” Username and Password...

CVE-2022-37935

HPE OneView for VMware vCenter, in certain circumstances, may disclose the “HPE OneView” Username and Password...

CVE-2022-37935

HPE OneView for VMware vCenter is affected by CVE-2022-37935, where under certain circumstances it may disclose the HPE OneView username and password. Affected component: HPE OneView for VMware vCenter; root cause involves insufficient protection of registration data. Impact is confidentiality (h...

CVE-2022-37935: Undefined Security Weakness

HPE OneView for VMware vCenter, in certain circumstances, may disclose the “HPE OneView” Username and Password...

PT-2023-2205 · Hewlett Packard · Hpe Oneview For Vmware Vcenter

Name of the Vulnerable Software and Affected Versions: HPE OneView for VMware vCenter affected versions not specified Description: The issue is related to insufficient protection of registration data, which may lead to the disclosure of the HPE OneView username and password. This could allow an...

HPESBGN04449 rev 2- HPE OneView for VMware vCenter, Local Disclosure of Sensitive Information

Potential Security Impact: Local: Disclosure of Sensitive Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE OneView for VMware vCenter/Operations Manager/Log Insight 9.6, 10.0, 10.1, 10.2, 10.3, 10.4, 11.0, 11.1,11.2 CVSS Scores: | CVE | CVSS Vector | Base Score | |...

CVE-2022-36416

Protection mechanism failure in the IntelR Ethernet 500 Series Controller drivers for VMware before version 1.10.0.13 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2022-36797

Protection mechanism failure in the IntelR Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2022-36416

Protection mechanism failure in the IntelR Ethernet 500 Series Controller drivers for VMware before version 1.10.0.13 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2022-36797

Protection mechanism failure in the IntelR Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenticated user to potentially enable denial of service via local access...

Session fixation

Protection mechanism failure in the IntelR Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2022-36797

Protection mechanism failure in the IntelR Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2022-36797

Protection mechanism failure in the IntelR Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenticated user to potentially enable denial of service via local access...