49 matches found
CVE-2023-20867
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine...
CVE-2023-20867
Summary: CVE-2023-20867 affects open-vm-tools (VMware Tools) with an authentication bypass in the vgauth module, enabling a fully compromised ESXi host to disrupt host-to-guest authentication and impact guest VM confidentiality and integrity. The issue is exploitable with root access on ESXi (loc...
CVE-2023-20867
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine...
CVE-2023-20867
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine...
CVE-2023-20867 VMware Tools Authentication Bypass Vulnerability
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine...
CVE-2023-20867
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine...
VulnCheck KEV: CVE-2023-20867
VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access...
Vulnerabilities fixed in VMWare products
Vulnerabilities have been fixed in several VMware products. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF. Access to system data A malicious person with administrator access to a...
Backups of VMs with enabled CBRC option fails when Linux backup proxies are used
Article Applicability This article discusses a limitation specific to Veeam Backup & Replication 10.x. When Linux-based VMware Backup Proxy was introduced in Veeam Backup & Replication 10, it could only use the Virtual Appliance HOTADD transport mode. Starting with Veeam Backup & Replication 11, ...
Processing configuration Error: The operation is not allowed in the current state. (The VM is in invalid state.)
Article Applicability This article's core error message, "The operation is not allowed in the current state. " may occur during other stages of a replication job or for different job types. This article, KB3000, is specific to when the error occurs during the Processing configuration stage of a...
ESXi 6.5 / 6.7 Multiple Vulnerabilities (VMSA-2019-0012)
The remote VMware ESXi host is version 6.5 or 6.7 and is affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. C Tenable Network Security, Inc. include'compat.inc'; if description...
Qualys Cloud Platform (VM, PC) 8.21 New Features
This new release of the Qualys Cloud Platform VM, PC, version 8.21, adds new technologies and platforms, and support for scanning ESXi hosts on vCenter for vulnerabilities. Feature Highlights Qualys Vulnerability Management VM Support for Scanning ESXi Hosts on vCenter for Vulnerabilities – Qualy...
CVE-2017-4940
The ESXi Host Client in VMware ESXi 6.5 before ESXi650-201712103-SG, 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG contains a vulnerability that may allow for stored cross-site scripting XSS. An attacker can exploit this vulnerability by injecting Javascript, which might get...
Manual Firewall changes for Veeam Backup from Storage Snapshot with Cisco HyperFlex IOvisor processing
Challenge This article describes making manual firewall changes for Veeam Backup from Storage Snapshot with Cisco HyperFlex IOvisor processing. For details on how to perform these firewall changes using a predefined VMware ESXi extension please review KB2298. HyperFlex Version Specific Article...
VMware ESXi updates address a cross-site scripting issue (VMSA-2016-003) - Remote Version Check
VMware ESXi updates address a critical glibc security vulnerability SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
VMware vSphere Client XXE Injection Information Disclosure (VMSA-2016-0022)
The version of vSphere Client installed on the remote Windows host is affected by an information disclosure vulnerability due to an incorrectly configured XML parser accepting XML external entities XXE from an untrusted source. An unauthenticated, remote attacker can exploit this issue to disclos...
VMware Security Updates for vCenter Server (VMSA-2014-0012)
The VMware vCenter Server installed on the remote host is version 5.0 prior to Update 3c, 5.1 prior to Update 3, or 5.5 prior to Update 2. It is, therefore, affected by multiple vulnerabilities in third party libraries : - Due to improper certificate validation when connecting to a CIM server on ...
CVE-2014-8371
VMware vCenter Server Appliance vCSA 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate...
CVE-2014-8371
VMware vCenter Server Appliance vCSA 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate...
Code injection
VMware vCenter Server Appliance vCSA 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate...