Photon OS 5.0: Libvirt PHSA-2026-5.0-90-0855

An update of the libvirt package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-0855. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

kernel: drm/radeon: check bo_va->bo is non-NULL before using it

A flaw was found in the Linux kernel's Radeon graphics driver. The driver fails to verify whether a memory buffer object pointer is valid before dereferencing it after freeing operations. A local user could exploit this flaw to cause a kernel crash, resulting in a Denial of Service DoS...

CVE-2021-38918

IBM PowerVM Hypervisor FW860, FW940, FW950, and FW1010, through a specific sequence of VM management operations could lead to a violation of the isolation between peer VMs. IBM X-Force ID: 210019...

PT-2022-10802

Name of the Vulnerable Software and Affected Versions IBM PowerVM Hypervisor versions FW860, FW940, FW950, and FW1010 Description The issue concerns a specific sequence of VM management operations that could lead to a violation of the isolation between peer VMs. Recommendations For IBM PowerVM...

CVE-2021-38918: Undefined Security Weakness

IBM PowerVM Hypervisor FW860, FW940, FW950, and FW1010, through a specific sequence of VM management operations could lead to a violation of the isolation between peer VMs. IBM X-Force ID: 210019...

Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

Microsoft Open Management Infrastructure OMI within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution...

Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability

Microsoft Open Management Infrastructure OMI within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation...

Additional Guidance Regarding OMI Vulnerabilities within Azure VM Management Extensions

Last updated on October 5, 2021: See revision history located at the end of the post for changes. On September 14, 2021, Microsoft released fixes for three Elevation of Privilege EoP vulnerabilities and one unauthenticated Remote Code Execution RCE vulnerability in the Open Management...

CVE-2018-11774: Improper Neutralization of Special Elements used in an SQL Command

Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL statements. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of securi...

PT-2019-8798

Name of the Vulnerable Software and Affected Versions Apache VCL versions 2.1 through 2.5 Description The issue arises from improper validation of form input when adding and removing VMs to and from hosts, which is then used in SQL statements, allowing for an SQL injection attack. Access to this...

CVE-2018-0238: Improper Authentication

A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System UCS Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on a...

CVE-2010-3988

Unspecified vulnerability in HP Insight Control Virtual Machine Management before 6.2 allows remote attackers to bypass intended access restrictions and cause a denial of service via unknown vectors...