CVE-2023-34037

VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests...

VMware Horizon Environment Issues Vulnerabilities

VMware Horizon is a suite of foundation platforms for virtual desktops and applications from VMware. The product enables end users to access all of their virtual desktops, applications and online services through a digital workspace. A security vulnerability exists in VMware Horizon Server that...

CVE-2023-34038: Undefined Security Weakness

VMware Horizon Server contains an information disclosure vulnerability. A malicious actor with network access may be able to access information relating to the internal network configuration...

CVE-2023-34037: Inconsistent Interpretation of HTTP Requests

VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests...

VMware Horizon Security Vulnerability

VMware Horizon is a suite of foundation platforms for virtual desktops and applications from VMware. The product enables end users to access all of their virtual desktops, applications and online services through a digital workspace. A security vulnerability exists in VMware Horizon Server, which...

Vulnerabilities fixed in VMware Horizon

VMware has fixed vulnerabilities in Horizon Server. A unauthenticated malicious party could exploit the vulnerabilities to gain access to system data, or through an HTTP-Request Smuggling potentially to gain access to sensitive data. The vulnerabilities are not present in the latest version of...

PT-2023-4288 · Vmware · Vmware Horizon Server

Name of the Vulnerable Software and Affected Versions: VMware Horizon Server affected versions not specified Description: The issue is related to a HTTP request smuggling vulnerability in VMware Horizon Server. A malicious actor with network access may be able to perform HTTP smuggle requests,...

PT-2023-4281 · Vmware · Vmware Horizon Server

Name of the Vulnerable Software and Affected Versions: VMware Horizon Server affected versions not specified Description: The issue is related to insufficient protection of service data, which may allow a remote attacker to gain unauthorized access to confidential information. A malicious actor...

VMware Horizon Server updates address multiple security vulnerabilities (CVE-2023-34037, CVE-2023-34038)

3a. Request smuggling vulnerability CVE-2023-34037 VMware Horizon Server contains a HTTP request smuggling vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3. 3b. Information disclosure vulnerability...

VMware SD-WAN Edge Web Interface Bypass

The vulnerability of the web interface of microprogramming software in VMware SD-WAN Edge devices is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain read, modify, or delete access to data by downloading the...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...

Kernel: vmwgfx: race condition leading to information disclosure vulnerability

...

CentOS: Security Advisory for open-vm-tools (CESA-2023:3944)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Metasploit Weekly Wrap up

Unauthenticated RCE in VMware Product This week, community contributor h00die added an exploit module that leverages a command injection vulnerability in VMWare Aria Operations for Networks, formerly known as vRealize Network Insight. Versions 6.2 to 6.10 are vulnerable CVE-2023-20887. A remote...

Security Bulletin: A VMWare Tanzu Spring Vulerability Affects IBM OpenPages with Watson (CVE-2022-22950)

Summary There is a vulnerability in the Spring Framework open source library used by IBM OpenPages with Watson. This affects the IBM OpenPages application server. This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2022-22950 DESCRIPTION: VMware Tanzu Spring Framework is...

CentOS 7 : open-vm-tools (RHSA-2023:3944)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3944 advisory. - A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the gues...

open security update

CentOS Errata and Security Advisory CESA-2023:3944 An update for open-vm-tools is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

VMWare Aria Operations For Networks Remote Command Execution Exploit

VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...

K000135621: VMware Tools vulnerability CVE-2023-20867

Security Advisory Description A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. CVE-2023-20867 Impact There is no impact; F5 products are not affected by this...

com.dubture.jenkins:digitalocean-plugin (>=0.9, <=0.12), com.inkysea.vmware.vra:vmware-vrealize-automation-plugin (>=1.2.1, <=1.2.3) +8 more potentially affected by CVE-2023-39151 via org.jenkins-ci.main:jenkins-core (1.642.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.642.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.dubture.jenkins:digitalocean-plugin =0.9, =1.2.1, =0.0.8, =0.6, =2.4.2, =1.13-alpha, =0.1...