Code injection

VMware vCenter Server Appliance vCSA 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate...

CVE-2014-8371

VMware vCenter Server Appliance vCSA 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate...

CVE-2014-8371

CVE-2014-8371 affects VMware vCenter Server and vCSA when connecting to an ESXi CIM server; root cause is improper certificate validation that enables MITM spoofing of CIM services. Affected versions: vCSA 5.5 before Update 2, vCenter Server 5.1 before Update 3, and 5.0 before Update 3c. Remediat...

CVE-2014-3797

CVE-2014-3797 is an XSS vulnerability in VMware vCenter Server Appliance (vCSA) 5.1 prior to Update 3, allowing remote attackers to inject arbitrary script/HTML via unspecified vectors. Connected sources confirm the issue and that remediation is available: vCSA 5.1 Update 3 (and related patches i...

VMSA-2014-0013:VMware vCloud Automation Center product updates address a CRITICAL remote privilege escalation vulnerability

VMSA-2014-0013 VMware vCloud Automation Center product updates address a critical remote privilege escalation vulnerability VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2014-0013 VMware Security Advisory Synopsis: VMware vCloud Automation Center product updates address a...

VMware Security Updates for vCenter Server (VMSA-2014-0012)

VMware vCenter product updates address a Cross Site Scripting issue, a certificate validation issue and security vulnerabilities in third-party libraries. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

VMware Releases Security Updates for vCenter Server, vCenter Server Appliance, and ESXi

VMware has released a security advisory to address multiple vulnerabilities in vCenter Server, vCenter Server Appliance, and ESXi. Exploitation of these vulnerabilities may allow a remote attacker to perform man-in-the-middle or cross-site scripting attacks. US-CERT encourages users and...

VMware vSphere product updates address security vulnerabilities

a. VMware vCSA cross-site scripting vulnerabilityVMware vCenter Server Appliance vCSA contains a vulnerability that may allow for Cross Site Scripting. Exploitation of this vulnerability in vCenter Server requires tricking a user to click on a malicious link or to open a malicious web page. VMwar...

VMware vCenter Server Appliance Bash Remote Code Execution (VMSA-2014-0010) (Shellshock)

The version of VMware vCenter Server Appliance installed on the remote host is 5.0 prior to Update 3b, 5.1 prior to Update 2b, or 5.5 prior to Update 2a. It therefore contains a version of bash that is affected by a command injection vulnerability via environment variable manipulation. Depending ...

VMSA-2014-0010:VMware product updates address CRITICAL Bash security vulnerabilities

VMSA-2014-0010.13 VMware product updates address critical Bash security vulnerabilities VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2014-0010.13 VMware Security Advisory Synopsis: VMware product updates address critical Bash security vulnerabilities VMware Security Advisor...

VMware Security Updates for vCenter Server (VMSA-2014-0008)

The VMware vCenter Server installed on the remote host is version 5.0 prior to Update 3c, 5.1 prior to Update 3, or 5.5 prior to Update 2. It is, therefore, affected by multiple vulnerabilities in third party libraries : - The bundled version of Apache Struts contains a code execution flaw. Note...

VMware Security Updates for vCenter Server (VMSA-2014-0008)

VMware has updated vSphere third party libraries. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vmware:vcenterserver";...

VMSA-2014-0008:VMware vSphere product updates to third party libraries

VMSA-2014-0008.2 VMware vSphere product updates to third party libraries VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2014-0008.2 VMware Security Advisory Synopsis: VMware vSphere product updates to third party libraries VMware Security Advisory Issue date: 2014-09-09 VMwar...

How to restore vCenter Server without a vCenter Server

Challenge The vCenter Server is not available and the vCenter Server VM needs to be restored. Solution To restore the vCenter Server, you will need to add one of the individual ESXi hosts to Veeam Backup & Replication, allowing you to target that host directly to restore the vCenter VM. Possible...

VMware vCenter Server Appliance Multiple Vulnerabilities (VMSA-2014-0006)

The version of VMware vCenter Server Appliance installed on the remote host is 5.0 prior to 5.0 Update 3a, 5.1 prior to 5.1 Update 2a, or 5.5 prior to 5.5 Update 1b. It is, therefore, affected by multiple vulnerabilities in the bundled OpenSSL library : - An error exists in the function...

VMware Security Updates for vCenter Server (VMSA-2014-0006)

VMware product updates address OpenSSL security vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2014-3790

Ruby vSphere Console RVC in VMware vCenter Server Appliance allows remote authenticated users to execute arbitrary commands as root by escaping from a chroot jail...

Design/Logic Flaw

Ruby vSphere Console RVC in VMware vCenter Server Appliance allows remote authenticated users to execute arbitrary commands as root by escaping from a chroot jail...

CVE-2014-3790

Ruby vSphere Console RVC in VMware vCenter Server Appliance allows remote authenticated users to execute arbitrary commands as root by escaping from a chroot jail...

CVE-2014-3790

The CVE-2014-3790 entry concerns VMware vCenter Server Appliance's Ruby vSphere Console (RVC). The vulnerability arises from escaping the chroot jail, enabling remote authenticated users to execute arbitrary commands as root. Documents consistently describe a privilege-escalation path via RVC tha...