[SECURITY] [DSA 5493-1] open-vm-tools security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5493-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 10, 2023 https://www.debian.org/security/faq -...

PoC Exploit Released for Critical VMware Aria's SSH Auth Bypass Vulnerability

Proof-of-concept PoC exploit code has been made available for a recently disclosed and patched critical flaw impacting VMware Aria Operations for Networks formerly vRealize Network Insight. The flaw, tracked as CVE-2023-34039, is rated 9.8 out of a maximum of 10 for severity and has been describe...

CVE-2023-20900

An improper signature verification flaw was found in open-vm-tools that may lead to a bypass of SAML token signature. A malicious actor that has been granted Guest Operation Privileges in a target virtual machine may be able to elevate their privileges if that target virtual machine has been...

SUSE SLES12: libvmtools0 / open-vm-tools / open-vm-tools-desktop / etc (SUSE-SU-2023:3506-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3506-1 advisory. - CVE-2023-20900: Fixed SAML token signature bypass vulnerability bsc1214566. Tenable has extracted the preceding description block directly...

SUSE SLES15: libvmtools-devel / libvmtools0 / open-vm-tools / etc (SUSE-SU-2023:3504-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3504-1 advisory. - CVE-2023-20867: Fixed authentication bypass vulnerability in the vgauth module bsc1212143. - CVE-2023-20900: Fixed SAML token...

SUSE SLES15: libvmtools-devel / libvmtools0 / open-vm-tools / etc (SUSE-SU-2023:3505-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3505-1 advisory. - CVE-2023-20867: Fixed authentication bypass vulnerability in the vgauth module bsc1212143. - CVE-2023-20900: Fixed SAML token...

SUSE: Security Advisory (SUSE-SU-2023:3507-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15: libvmtools-devel / libvmtools0 / open-vm-tools / etc (SUSE-SU-2023:3507-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3507-1 advisory. - CVE-2023-20900: Fixed SAML token signature bypass vulnerability bsc1214566. This update also ships a...

SUSE: Security Advisory (SUSE-SU-2023:3506-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-20900

creationtimestamp| type| source ---|---|--- 2023-08-31 14:12:53+00:00| seen| https://t.me/cibsecurity/69536...

CVE-2023-20900

CVE-2023-20900 is a vulnerability in Open VMware Tools (open-vm-tools) where a malicious actor with Guest Operation Privileges may elevate to a higher privilege via a more-privileged Guest Alias in the VM. The connected documents confirm Open VM Tools is affected and describe a SAML token signatu...

VMware Tools updates address a SAML Token Signature Bypass Vulnerability (CVE-2023-20900)

3. SAML Token Signature Bypass vulnerability CVE-2023-20900 VMware Tools contains a SAML token signature bypass vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.1...

VMSA-2023-0019:VMware Tools updates address a SAML Token Signature Bypass Vulnerability

Advisory ID: VMSA-2023-0019.1 CVSSv3 Range: 7.1 Issue Date:2023-08-31 Updated On: 2023-09-05 CVEs: CVE-2023-20900 Synopsis: VMware Tools updates address a SAML Token Signature Bypass Vulnerability CVE-2023-20900 RSS Feed Download PDF Download Text File Share this page on social media: 1. Impacted...

CVE-2022-20900

CVE-2022-20900 covers multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. The issues stem from insufficient validation of user fields in incoming HTTP packets, exploitable by an authenticated administrator via crafted r...

CVE-2020-20900

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-22032. Reason: This candidate is a duplicate of CVE-2020-22032. Notes: All CVE users should reference CVE-2020-22032 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2020-20900

...

CVE-2020-20900

CVE-2020-20900 is rejected/not used; reference CVE-2020-22032 instead.

CVE-2019-20900

The CVE-2019-20900 issue affects Atlassian Jira Server and Data Center in the Add Field module, causing a stored cross-site scripting (XSS) vulnerability. Affected versions are Jira Server/Data Center before 8.7.0, with a fixed version reported as 8.7.0. The connected documents confirm the vulner...

Stored XSS in Add Field module - CVE-2019-20900

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the Add Field module. Affected versions: version 8.7.0 Fixed versions: 8.7.0...

Stored XSS in Add Field module - CVE-2019-20900

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the Add Field module. Affected versions: version 8.7.0 Fixed versions: 8.7.0...