CVE-2021-22033

CVE-2021-22033 affects VMware vRealize Operations prior to 8.6. The root cause is a Server Side Request Forgery (SSRF) vulnerability. Impact is Low CVSS v3.1 (2.7) with network access, requiring admin privileges and no user interaction. Remediation is to apply the fixed versions: vRealize Operati...

CVE-2021-22036: Exposure of Sensitive Information to an Unauthorized Actor

VMware vRealize Orchestrator 8.x prior to 8.6 contains an open redirect vulnerability due to improper path handling. A malicious actor may be able to redirect victim to an attacker controlled domain due to improper path handling in vRealize Orchestrator leading to sensitive information disclosure...

CVE-2021-22033: Server-Side Request Forgery (SSRF)

Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery SSRF vulnerability...

VMI web interface Privilege Escalation

The vulnerability in the VCenter Server Management Interface of the VMware vCenter Server web interface relates to deficiencies in system security restrictions. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information by sending a specially crafte...

CVE-2021-22035: Improper Neutralization of Special Elements in Output Used by a Downstream Component

VMware vRealize Log Insight 8.x prior to 8.6 contains a CSVComma Separated Value injection vulnerability in interactive analytics export function. An authenticated malicious actor with non-administrative privileges may be able to embed untrusted data prior to exporting a CSV sheet through Log...

VMware vCenter Server Content Library Unauthorized Access

The vulnerability of the Content Library component in the VMware vCenter Server management tool is related to deficiencies in the authentication mechanism for end points. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information by sending a...

VMware vCenter Server Privilege Escalation

The vulnerability of the management tool for virtual infrastructure, VMware vCenter Server, is related to insufficient verification of session tokens. Exploiting this vulnerability can allow attackers to increase their privileges...

VAPI Service DoS

The vulnerability of the VAPI service, a component of the VMware vCenter Server virtual infrastructure management tool, involves an uncontrolled consumption of resources. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending a specially crafted HTTP...

VPXD Service DoS

The vulnerability of the VPXD service Virtual Provisioning X Daemon, a management tool for VMware vCenter Server’s virtual infrastructure, is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending a...

VMware vCenter Server SSRF

The vulnerability of the Content Library component in the VMware vCenter Server management tool is related to insufficient verification of URL addresses. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack using a specially created POST request...

VMware vCenter Server XML Parsing DoS

The vulnerability of the VMware vCenter Server virtual infrastructure management tool is related to incorrect syntactic analysis of XML objects. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Vmware VMware vRealize Log Insight information leakage vulnerability

VMware vRealize Orchestrator is a modern workflow automation platform that simplifies and automates complex data center infrastructure processes VMware vRealize Orchestrator has an open redirection vulnerability that could be exploited by an attacker to redirect victims to an attacker-controlled...

Veeam Verified: Primary Storage for Continuous Data Protection (CDP) with VMware VVOL

Purpose This article lists storage systems that Veeam has tested for use with VMware VVOL and Veeam's Continuous Data Protection CDP Replication. Tested Alliance Vendor Product Lines Cisco FlashStack based on Pure Storage FlashArray Cisco FlexPod based on NetApp ONTAP Cisco SmarStack based on HPE...

VMware vCenter Managed ESXi Installed VIBs

Binary data vmwarevcenterinstalledvibs.nbin...

VMware vRealize Orchestrator update addresses open redirect vulnerability (CVE-2021-22036)

3. VMware vRealize Orchestrator update addresses open redirect vulnerability CVE-2021-22036 VMware vRealize Orchestrator contains an open redirect vulnerability due to improper path handling. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv...

PT-2021-7278

Name of the Vulnerable Software and Affected Versions VMware vRealize Log Insight versions 8.0 through 8.5 Description The issue is related to a CSV injection vulnerability in the interactive analytics export function of VMware vRealize Log Insight. This vulnerability can be exploited by an...

PT-2021-7282

Name of the Vulnerable Software and Affected Versions VMware vRealize Operations versions prior to 8.6 Description The issue is related to a Server Side Request Forgery SSRF vulnerability, which is caused by insufficient validation of incoming requests. This vulnerability can be exploited by a...

PT-2021-7283

Name of the Vulnerable Software and Affected Versions VMware vRealize Orchestrator versions 8.x prior to 8.6 Description The issue is related to improper path handling, which may allow a malicious actor to redirect victims to an attacker-controlled domain, potentially leading to sensitive...

VMware, VMware vRealize Operations – Code-related issues and vulnerabilities

vmware VMware vRealize Operations is an application from vmware, Inc. A unified, AI-based platform for private, hybrid, and multi-cloud environments that delivers IT operations management on autopilot. A code issue vulnerability exists in VMware vRealize Log Insight that stems from insufficient...

Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities

Summary IBM Data Risk Manager has addressed the following vulnerabilities: Vulnerability Details CVEID: CVE-2021-20227 DESCRIPTION: SQLite is vulnerable to a denial of service, caused by a use-after-free flaw in the SELECT query function in src/select.c. By sending a specially-crafted request, a...