CVE-2015-1047

VMware products affected by CVE-2015-1047 include vCenter Server (vpxd) 5.0 before u3e, 5.1 before u3, and 5.5 before u2 (DoS via long heartbeat) and ESXi 5.0/5.1/5.5 with OpenSLP OpenSLP OpenSLP double-free in SLPDProcessMessage() leading to remote code execution or denial of service. Patches/up...

CVE-2015-2342: Undefined Security Weakness

The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol...

CVE-2015-1047: Improper Input Validation

vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message...

VMware vCenter Server JMX RMI Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of VMware vCenter Server. Authentication is not required to exploit this vulnerability. The specific flaw exists in the configuration of the JMX remote interface. This interface allows a remote attack...

VMware vCenter Multiple Vulnerabilities (VMSA-2015-0007)

The VMware vCenter Server installed on the remote host is affected by the following vulnerabilities : - A flaw exists in the vpxd service due to improper sanitization of long heartbeat messages. An unauthenticated, remote attacker can exploit this to cause a denial of service. CVE-2015-1047 - A...

PT-2015-2314

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 5.0 through 5.0 u3e VMware vCenter Server versions 5.1 through 5.1 u3b VMware vCenter Server versions 5.5 through 5.5 u3 VMware vCenter Server versions 6.0 through 6.0 u1 Description The issue is related to the J...

VMware vCenter Server LDAP Certificate Validation Bypass Vulnerability

VMware vCenter Server provides centralized visibility, proactive management and extensibility into virtual infrastructures. VMware vCenter Server fails to validate TLS certificates when binding to LDAP servers, allowing an attacker to intercept communications between an LDAP server and a target...

PT-2015-7411

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 5.5 before u3 and 6.0 before u1 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted X.509 certificate, as the software does not verify X.509...

CVE-2015-6932: Undefined Security Weakness

VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

VMware vCenter Server updates address a LDAP certificate validation issue

VMware vCenter Server LDAP certificate validation vulnerability. VMware vCenter Server does not validate the certificate when connecting to a single sign on identity source using LDAPS LDAP over SSL. This applies when connecting to Active Directory as an LDAP Server or OpenLDAP. Exploitation of...

KLA10665 Obtain sensitive information vulnerability in VMware vCenter Server

Improper certificate validation was found in VMware vCenter Server. By exploiting this vulnerability malicious users can obtain sensitive information. This vulnerability can be exploited remotely via a traffic interception. Technical details This vulnerability can be exploited when vCenter Server...

PT-2015-2315

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 5.0 through 5.0 u3e VMware vCenter Server versions 5.1 through 5.1 u3 VMware vCenter Server versions 5.5 through 5.5 u2 Description The issue allows remote attackers to cause a denial of service. This is due to...

VMware vCenter Server Multiple Java Vulnerabilities (VMSA-2015-0003) (POODLE)

The VMware vCenter Server installed on the remote host is version 5.0 prior to 5.0u3d, 5.1 prior to 5.1u3a, 5.5 prior to 5.5u2e, or 6.0 prior to 6.0.0a. It is, therefore, affected by a man-in-the-middle MitM information disclosure vulnerability known as POODLE, related to the bundled JRE componen...

VMware Security Updates for vCenter Server (VMSA-2015-0001) (POODLE)

The VMware vCenter Server installed on the remote host is version 5.5 prior to Update 2d. It is, therefore, affected by multiple vulnerabilities in the included OpenSSL library : - An error exists related to DTLS SRTP extension handling and specially crafted handshake messages that can allow deni...

VMware Security Updates for vCenter Server (VMSA-2014-0012)

The VMware vCenter Server installed on the remote host is version 5.0 prior to Update 3c, 5.1 prior to Update 3, or 5.5 prior to Update 2. It is, therefore, affected by multiple vulnerabilities in third party libraries : - Due to improper certificate validation when connecting to a CIM server on ...

VMware vCenter Server Appliance Unspecified XSS (VMSA-2014-0012)

The version of VMware vCenter Server Appliance installed on the remote host is 5.1 prior to Update 3. It is, therefore, affected by an unspecified cross-site scripting vulnerability. A remote attacker can exploit this by means of a specially crafted URL or malicious web page, which can result in...

CVE-2014-8371

VMware vCenter Server Appliance vCSA 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate...

CVE-2014-3797

Cross-site scripting XSS vulnerability in VMware vCenter Server Appliance vCSA 5.1 before Update 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8371: Undefined Security Weakness

VMware vCenter Server Appliance vCSA 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate...

CVE-2014-3797: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in VMware vCenter Server Appliance vCSA 5.1 before Update 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...