KLA11110 Multiple vulnerabilities in VMware products

Multiple serious vulnerabilities have been found in VMware products. Malicious users can exploit these vulnerabilities to cause denial of service, privelege escalation, cross site scripting and arbitary code execution. Below is a complete list of vulnerabilities : 1. Out-of-bounds write...

VMware vSphere Data Protection (VDP) Multiple Vulnerabilities

VMware vSphere Data Protection VDP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

vCenter Server Appliance - Backup/Restore Recommendations

Native File-Based Backup and Restore Recommended vCenter Server Appliance Data Integrity Best Practices recommends using the native file-based backup and restore operations to protect the vCenter Server Appliance. Review: VMware vSphere User Guide: Considerations and Limitations for File-Based...

Privilege escalation

VMware vCenter Server 6.5 prior to 6.5 U1 contains an insecure library loading issue that occurs due to the use of LDLIBRARYPATH variable in an unsafe manner. Successful exploitation of this issue may allow unprivileged host users to load a shared library that may lead to privilege escalation...

CVE-2017-4923

VMware vCenter Server 6.5 prior to 6.5 U1 contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when using the vCenter Server Appliance file-based backup feature...

CVE-2017-4921

VMware vCenter Server 6.5 prior to 6.5 U1 contains an insecure library loading issue that occurs due to the use of LDLIBRARYPATH variable in an unsafe manner. Successful exploitation of this issue may allow unprivileged host users to load a shared library that may lead to privilege escalation...

CVE-2017-4921

VMware vCenter Server 6.5 prior to 6.5 U1 contains an insecure library loading issue that occurs due to the use of LDLIBRARYPATH variable in an unsafe manner. Successful exploitation of this issue may allow unprivileged host users to load a shared library that may lead to privilege escalation...

CVE-2017-4923

VMware vCenter Server 6.5 prior to 6.5 U1 contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when using the vCenter Server Appliance file-based backup feature...

Information disclosure

VMware vCenter Server 6.5 prior to 6.5 U1 contains an information disclosure issue due to the service startup script using world writable directories as temporary storage for critical information. Successful exploitation of this issue may allow unprivileged host users to access certain critical...

Information disclosure

VMware vCenter Server 6.5 prior to 6.5 U1 contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when using the vCenter Server Appliance file-based backup feature...

CVE-2017-4922

VMware vCenter Server 6.5 prior to 6.5 U1 contains an information disclosure issue due to the service startup script using world writable directories as temporary storage for critical information. Successful exploitation of this issue may allow unprivileged host users to access certain critical...

CVE-2017-4922

VMware vCenter Server 6.5 prior to 6.5 U1 contains an information disclosure issue due to the service startup script using world writable directories as temporary storage for critical information. Successful exploitation of this issue may allow unprivileged host users to access certain critical...

CVE-2017-4923

CVE-2017-4923 affects VMware vCenter Server Appliance backup: version 6.5 before 6.5 U1 stores sensitive backup data in plaintext, enabling information disclosure. Root cause: plaintext storage of credentials in the vCenter backup feature. Impact: plaintext credentials disclosure possible via fil...

CVE-2017-4921

The CVE-2017-4921 issue affects VMware vCenter Server 6.5 prior to 6.5 U1. The root cause is an insecure library loading mechanism that uses LD_LIBRARY_PATH in an unsafe way, which can allow an unprivileged host user to load a shared library and potentially escalate privileges. Relevant connected...

CVE-2017-4922

The CVE-2017-4922 entry affects VMware vCenter Server (6.5 prior to 6.5 U1) and is an information-disclosure vulnerability caused by the service startup script using world-writable directories for temporary storage. This design allows unprivileged host users to access certain sensitive informatio...

CVE-2017-4922

VMware vCenter Server 6.5 prior to 6.5 U1 contains an information disclosure issue due to the service startup script using world writable directories as temporary storage for critical information. Successful exploitation of this issue may allow unprivileged host users to access certain critical...

CVE-2017-4921

VMware vCenter Server 6.5 prior to 6.5 U1 contains an insecure library loading issue that occurs due to the use of LDLIBRARYPATH variable in an unsafe manner. Successful exploitation of this issue may allow unprivileged host users to load a shared library that may lead to privilege escalation...

CVE-2017-4923

VMware vCenter Server 6.5 prior to 6.5 U1 contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when using the vCenter Server Appliance file-based backup feature...

VMware vCenter Server Local Information Disclosure Vulnerability

VMware vCenter Server is a suite of server and virtualization management software from VMware. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructures. A local information disclosure vulnerability...

VMware vCenter Server Information Disclosure Vulnerability (CNVD-2017-26825)

VMware vCenter Server is a suite of server and virtualization management software from VMware. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructures. An information disclosure vulnerability exis...