315 matches found
CVE-2026-22720
VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, apply the patches listed in the 'Fixed...
CVE-2026-22720
VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, apply the patches listed in the 'Fixed...
CVE-2026-22719
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. To remediate...
CVE-2026-22721
VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721, apply the patches listed in the 'Fix...
CVE-2026-22721
CVE-2026-22721 affects VMware Aria Operations (8.x) prior to 8.18.6. A privileged actor in vCenter who can access Aria Operations can escalate to administrative rights. Remediation is via patches listed in the Fixed Version column of the VMSA-2026-0001 response matrix (Broadcom VMware security ad...
CVE-2026-22721 VMware Aria Operations privilege escalation vulnerability
VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721, apply the patches listed in the 'Fix...
CVE-2026-22720
VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, apply the patches listed in the 'Fixed...
CVE-2026-22720 VMware Aria Operations stored cross-site scripting vulnerability
VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, apply the patches listed in the 'Fixed...
CVE-2023-54296
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration Fix a goof where KVM tries to grab source vCPUs from the destination VM when doing intrahost migration. Grabbing the wrong vCPU not only hoses the guest, it...
UBUNTU-CVE-2023-54296
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration Fix a goof where KVM tries to grab source vCPUs from the destination VM when doing intrahost migration. Grabbing the wrong vCPU not only hoses the guest, it...
CVE-2023-54296
CVE-2023-54296 concerns the Linux kernel KVM/SMV intrahost migration path. The issue fixed a bug where KVM would grab source vCPUs from the destination VM during intrahost migration, which could cause the guest to fail and the host to crash because the VMSA pointer could be left NULL. The descrip...
VMware Tools 11.x < 12.5.4 / 13.x < 13.0.5 Multiple Vulnerabilities (VMSA-2025-0015)
The version of VMware Tools installed on the remote host is 11.x or 12.x prior to 12.5.4, or 13.x prior to 13.0.5. It is, therefore, affected by multiple vulnerabilities as disclosed in the VMSA-2025-0015 advisory: - VMware Aria Operations and VMware Tools contain a local privilege escalation...
VMware vCenter Server 7.0.x < 7.0 U3w / 8.0.x < 8.0 U3g SMTP Header Injection (VMSA-2025-0016)
The version of VMware vCenter Server installed on the remote host is 7.0.x prior to 7.0 U3w, or 8.0.x prior to 8.0 U3g. It is, therefore, affected by a vulnerability as referenced in the VMSA-2025-0016 advisory: - VMware vCenter contains an SMTP header injection vulnerability. A malicious actor...
VMware vCenter Server 7.0.x < 7.0 U3v / 8.0.x < 8.0 U3g DoS (VMSA-2025-0014)
The version of VMware vCenter Server installed on the remote host is 7.0.x prior to 7.0 U3v, or 8.0.x prior to 8.0 U3g. It is, therefore, affected by a vulnerability as referenced in the VMSA-2025-0014 advisory. A malicious actor who is authenticated through vCenter and has permission to perform...
CVE-2025-38026
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-38026
A Linux kernel vulnerability (x86/sev) affecting kdump with makedumpfile to dump SNP guest memory can touch VMSA pages of the vCPU running kdump, causing unrecoverable #NPF/RMP faults as VMSA pages are busy. This may hang guests and halt other APs. Resolution involves AP DESTROY GHCB calls to kic...
PT-2025-25801 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, related to the x86/sev component. The issue occurs when kdump is running makedumpfile to generate vmcore and dump SNP guest memor...
VMware vCenter Server 7.0.x < 7.0 U3v / 8.0.x < 8.0 U3e Authenticated Command Execution (CVE-2025-41225) (VMSA-2025-0010)
The version of VMware vCenter Server installed on the remote host is 7.0.x prior to 7.0 U3v, 8.0.x prior to 8.0 U3e. It is, therefore, affected by a vulnerability as referenced in the VMSA-2025-0010 advisory. - The vCenter Server contains an authenticated command-execution vulnerability...
CVE-2025-22249
CVE-2025-22249 is a DOM-based Cross‑Site Scripting (XSS) flaw in VMware Aria Automation. Affected product: VMware Aria Automation (8.18.x line). Root cause: DOM-based XSS that enables an attacker to steal the access token of a logged-in user by convincing the user to click a malicious crafted pay...