VMware ESXi Buffer Overflow DoS

The vulnerability of VMware ESXi, VMware Workstation, and VMware Fusion lies in the issue of writing beyond buffer boundaries. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...

Security Bulletin: Vulnerability identified in VMWare affects Cloud Pak System (CVE-2020-3976)

Summary Vulnerability has been identified in VMware component used by Cloud Pak System. VMware component is at risk if enabled for external remote access. IBM Cloud Pak Systems by default does not provide remote external access. Vulnerability details and information about fixes has been published...

VMware Horizon Server Cross-Site Scripting Vulnerability

VMware Horizon is a suite of foundation platforms for virtual desktops and applications from VMware. It enables end users to access all of their virtual desktops, applications and online services through a digital workspace. A cross-site scripting vulnerability exists in VMware Horizon Server,...

VMware VCenter Server Directory Service Authentication Bypass (CVE-2020-3952)

An authentication bypass vulnerability exists in VMware VCenter Server Directory Service. Successful exploitation of this vulnerability could allow a remote attacker to gain unauthorized access to the affected system...

Photon OS 3.0: Containerd PHSA-2020-3.0-0155

An update of the containerd package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0155. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid141867;...

Photon OS 3.0: Oniguruma PHSA-2020-3.0-0155

An update of the oniguruma package has been released. File data PhotonOSPHSA-2020-30-0155oniguruma.nasl...

CVE-2020-3998

VMware Horizon Client for Windows 5.x prior to 5.5.0 contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed may be able to retrieve hashed credentials if the client crashes...

CVE-2020-3997

VMware Horizon Server 7.x prior to 7.10.3 or 7.13.0 contains a Cross Site Scripting XSS vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed...

CVE-2020-3997

VMware Horizon Server 7.x prior to 7.10.3 or 7.13.0 contains a Cross Site Scripting XSS vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed...

Information disclosure

VMware Horizon Client for Windows 5.x prior to 5.5.0 contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed may be able to retrieve hashed credentials if the client crashes...

Cross site scripting

VMware Horizon Server 7.x prior to 7.10.3 or 7.13.0 contains a Cross Site Scripting XSS vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed...

CVE-2020-3998

VMware Horizon Client for Windows 5.x prior to 5.5.0 contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed may be able to retrieve hashed credentials if the client crashes...

CVE-2020-3998

CVE-2020-3998 affects VMware Horizon Client for Windows versions prior to 5.5.0. The vulnerability is an information-disclosure flaw in the Horizon Client on Windows where a malicious local user can retrieve hashed credentials if the client crashes. Affected software: Horizon Client for Windows (...

CVE-2020-3997

VMware Horizon Server 7.x prior to 7.10.3 or 7.13.0 contains a Cross Site Scripting XSS vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed...

CVE-2020-3997

CVE-2020-3997 is a Cross Site Scripting (XSS) vulnerability in VMware Horizon Server (affecting 7.x prior to 7.10.3 or 7.13.0). VMware describes that the server does not correctly validate user input, allowing an attacker to inject and execute malicious scripts. The issue is addressed in VMware’s...

Photon OS 1.0: Envoy PHSA-2020-1.0-0335

An update of the envoy package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0335. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid141859...

CVE-2020-3998: Undefined Security Weakness

VMware Horizon Client for Windows 5.x prior to 5.5.0 contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed may be able to retrieve hashed credentials if the client crashes...

CVE-2020-3997: Improper Neutralization of Input During Web Page Generation

VMware Horizon Server 7.x prior to 7.10.3 or 7.13.0 contains a Cross Site Scripting XSS vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed...

Vulnerabilities fixed in VMware Horizon Server and Client

Vulnerabilities have been fixed in VMware Horizon Server and Client. The vulnerabilities allow a malicious party to access system data and to execute arbitrary code under the user's privileges. VMware has released updates to fix the vulnerabilities. More information can be found on the page below...

VMware Horizon Server and VMware Horizon Client updates address multiple security vulnerabilities (CVE-2020-3997, CVE-2020-3998)

3a. VMware Horizon Server Cross Site Scripting XSS vulnerability CVE-2020-3997 VMware Horizon Server does not correctly validate user input. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.1. 3b. VMware Horizon Client for...