VMware vCenter Chargeback Manager ImageUploadServlet Arbitrary File Upload (CVE-2013-3520)

An Arbitrary File Upload vulnerability has been reported in VMware vCenter Chargeback Manager...

Session fixation

Session fixation vulnerability in the vSphere Web Client Server in VMware vCenter Server 5.0 before Update 3 allows remote attackers to hijack web sessions and gain privileges via unspecified vectors...

CVE-2013-5971

Session fixation vulnerability in the vSphere Web Client Server in VMware vCenter Server 5.0 before Update 3 allows remote attackers to hijack web sessions and gain privileges via unspecified vectors...

CVE-2013-5971: Undefined Security Weakness

Session fixation vulnerability in the vSphere Web Client Server in VMware vCenter Server 5.0 before Update 3 allows remote attackers to hijack web sessions and gain privileges via unspecified vectors...

PT-2013-5894

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 5.0 through 5.0 Update 2 Description A session fixation issue in the vSphere Web Client Server allows remote attackers to hijack web sessions and gain privileges. Recommendations For versions 5.0 through 5.0 Upda...

VMware vCenter Operations Manager Arbitrary File Upload (VMSA-2012-0013)

The version of vCenter Operations Manager installed on the remote host is earlier than 5.0.3. It is, therefore, potentially affected by an arbitrary file upload vulnerability in the Apache Struts component. By exploiting this flaw, a remote, unauthenticated attacker could overwrite arbitrary file...

VMware vCenter Chargeback Manager ImageUploadServlet Arbitrary File Upload

This Metasploit module exploits a code execution flaw in VMware vCenter Chargeback Manager, where the ImageUploadServlet servlet allows unauthenticated file upload. The files are uploaded to the /cbmui/images/ web path, where JSP code execution is allowed. The module has been tested successfully ...

VMware vCenter - Chargeback Manager ImageUploadServlet Arbitrary File Upload (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 /Apache.Win32/ include...

VMware vCenter Chargeback Manager ImageUploadServlet Arbitrary File Upload

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 /Apache.Win32/ include...

Code injection

VMware vCenter Chargeback Manager aka CBM before 2.5.1 does not proper handle uploads, which allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2013-3520: Improper Control of Generation of Code

VMware vCenter Chargeback Manager aka CBM before 2.5.1 does not proper handle uploads, which allows remote attackers to execute arbitrary code via unspecified vectors...

PT-2013-4451

Name of the Vulnerable Software and Affected Versions VMware vCenter Chargeback Manager versions prior to 2.5.1 Description The issue allows remote attackers to execute arbitrary code via unspecified vectors due to improper handling of uploads. Recommendations For versions prior to 2.5.1, update ...

VMware vCenter Update Manager Multiple Vulnerabilities (VMSA-2012-0013)

The version of VMware vCenter Update Manager installed on the remote Windows host is 4.0 earlier than Update 4a, or 4.1 earlier than Update 3. Such versions use a version of the Oracle JRE 1.5 that is affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

VMware vCenter Chargeback Manager Installed

VMware vCenter Chargeback Manager, a cost reporting application, is installed on the remote Windows host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid66896; scriptversion"1.9"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/10/10";...

VMware vCenter Chargeback Manager Remote Code Execution (VMSA-2013-0008)

The version of VMware vCenter Chargeback Manager installed on the remote Windows host is potentially affected by a remote code execution vulnerability due to a flaw in the handling of file uploads. By exploiting this flaw, a remote, unauthenticated attacker could execute arbitrary code subject to...

VMware vCenter Server Multiple Vulnerabilities (VMSA-2012-0005)

The version of VMware vCenter Server installed on the remote host is 4.0 before Update 4a, 4.1 before Update 3, or 5.0 before Update 1. As such it is potentially affected by multiple vulnerabilities in the embedded Apache Tomcat server and the Oracle Sun Java Runtime Environment. C Tenable Networ...

CVE-2013-1212

The SSL functionality in Cisco NX-OS on the Nexus 1000V does not properly verify X.509 certificates, which allows man-in-the-middle attackers to spoof servers, and intercept or modify Virtual Supervisor Module VSM to VMware vCenter communication, via a crafted certificate, aka Bug ID CSCud14837...

Design/Logic Flaw

The SSL functionality in Cisco NX-OS on the Nexus 1000V does not properly verify X.509 certificates, which allows man-in-the-middle attackers to spoof servers, and intercept or modify Virtual Supervisor Module VSM to VMware vCenter communication, via a crafted certificate, aka Bug ID CSCud14837...

CVE-2013-1212

The SSL functionality in Cisco NX-OS on the Nexus 1000V does not properly verify X.509 certificates, which allows man-in-the-middle attackers to spoof servers, and intercept or modify Virtual Supervisor Module VSM to VMware vCenter communication, via a crafted certificate, aka Bug ID CSCud14837...

PT-2013-2975

Name of the Vulnerable Software and Affected Versions Cisco Nexus 1000V affected versions not specified Description The SSL functionality in Cisco NX-OS does not properly verify X.509 certificates, allowing man-in-the-middle attackers to spoof servers and intercept or modify Virtual Supervisor...