PT-2020-4966

Name of the Vulnerable Software and Affected Versions VMware ESXi versions 7.0 before ESXi70U1b-17168206 VMware ESXi versions 6.7 before ESXi670-202011101-SG VMware ESXi versions 6.5 before ESXi650-202011301-SG Description The issue exists in the way certain system calls are being managed, allowi...

KLA12101 Use after free vulnerability in VMware Workstation and Player

A use after free vulnerability was found in VMware Workstation and Player. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories VMSA-2020-0026 Exploitation Related products VMware-Workstation VMware-Player CVE list CVE-2020-4004 critical Solution Update to...

VMware ESXi, Workstation and Fusion updates address use-after-free and privilege escalation vulnerabilities (CVE-2020-4004, CVE-2020-4005)

3a. Use-after-free vulnerability in XHCI USB controller CVE-2020-4004 VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9....

VMware Fusion 11.0.x < 11.5.6 Multiple Vulnerabilities (VMSA-2020-0023)

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 11.0.x prior to 11.5.6. It is, therefore, affected by the following vulnerabilities: - A time-of-check time-of-use flaw exists related to ACPI device handling that allows an authenticated administrator to leak memory...

VMware Horizon XSS

The vulnerability of the VMware Horizon workstation virtualization system server is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to perform domain-joining attacks...

VMware Horizon Client Unauthorized Access

The vulnerability of the client system of VMware Horizon Client for Windows in virtualized workstations is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Vmware VMWare SD-WAN Orchestrator Authorization Issues Vulnerability

Vmware VMWare SD-WAN Orchestrator is a software from Vmware that orchestrates network data flows in a software-defined network architecture. The software provides Web pages to visually manage users, gateways, and authentication. An authorization issue vulnerability exists in VMware SD-WAN...

VMWare SD-WAN Orchestrator Trust Management Issue Vulnerability

Vmware VMWare SD-WAN Orchestrator is a software from Vmware that orchestrates network data flows in a software-defined network architecture. The software provides Web pages to visualize and manage users, gateways, and authentication. A security vulnerability exists in VMware SD-WAN Orchestrator...

VMware Carbon Black Announces Splunk Integration to Streamline and Modernize SOC Workflows

Introducing Unified VMware Carbon Black Cloud App for Splunk At VMware Carbon Black, our ecosystem of integration and alliance partners has been a core part of our vision and strategy. Today, with thousands of customers adopting the VMware Carbon Black Cloud to secure their endpoints and workload...

fence security update

CentOS Errata and Security Advisory CESA-2020:5003 An update for fence-agents is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

VMware SD-WAN Orchestrator updates address multiple security vulnerabilities (CVE-2020-3984, CVE-2020-3985, CVE-2020-4000, CVE-2020-4001, CVE-2020-4002 ,CVE-2020-4003)

3a. SQL injection vulnerability due to improper input validation CVE-2020-3984 The SD-WAN Orchestrator does not apply correct input validation which allows for SQL-injection. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of...

Photon OS 2.0: Apache PHSA-2020-2.0-0295

An update of the apache package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0295. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid14298...

Photon OS 2.0: Pam_Tacplus PHSA-2020-2.0-0295

An update of the pamtacplus package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0295. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 2.0: Python3 PHSA-2020-2.0-0295

An update of the python3 package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0295. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 2.0: Ruby PHSA-2020-2.0-0295

An update of the ruby package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0295. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid142988;...

VMSA-2020-0026:VMware ESXi, Workstation and Fusion updates address use-after-free and privilege escalation vulnerabilities

Advisory ID: VMSA-2020-0026.1 CVSSv3 Range: 8.8 - 9.3 Issue Date:2020-11-19 Updated On: 2020-11-24 CVEs: CVE-2020-4004, CVE-2020-4005 Synopsis: VMware ESXi, Workstation and Fusion updates address use-after-free and privilege escalation vulnerabilities CVE-2020-4004, CVE-2020-4005 RSS Feed Downloa...

VMware ESXi OpenSLP Remote Code Execution Vulnerability (CVE-2020-3992 and CVE-2019-5544): What You Need To Know

What’s up? On November 6, 2020 Microsoft’s Kevin Beaumont alerted the community to evidence of active exploitation attempts of CVE-2020-3992 and/or CVE-2019-5544, which are remote code execution RCE vulnerabilities in VMware ESXi’s service location protocol SLP service. VMware had issued a patch...

VulnCheck KEV: CVE-2020-3992

OpenSLP as used in VMware ESXi 7.0 before ESXi7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free...

VulnCheck KEV: CVE-2019-5544

VMware ESXi and Horizon Desktop as a Service DaaS OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution...

Photon OS 3.0: Libarchive PHSA-2020-3.0-0160

An update of the libarchive package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0160. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid142658;...