13365 matches found
SUSE-SU-2022:2349-1 Security update for ignition
This update for ignition fixes the following issues: - CVE-2022-1706: Fixed accessible configs from unprivileged containers in VMs running on VMware products bsc1199524. - Update to version 2.14.0...
VMSA-2022-0020:VMware ESXi addresses Return-Stack-Buffer-UnderfLOW and Branch Type Confusion vulnerabilities
Advisory ID: VMSA-2022-0020.2 CVSSv3 Range: 5.6 Issue Date:2022-07-12 Updated On: 2022-10-25 CVEs: CVE-2022-29901, CVE-2022-28693, CVE-2022-23816, CVE-2022-23825, CVE-2022-26373 Synopsis: VMware ESXi addresses Return-Stack-Buffer-Underflow and Branch Type Confusion vulnerabilities RSS Feed Downlo...
VMSA-2022-0018:VMware vCenter Server updates address a server-side request forgery vulnerability
Advisory ID: VMSA-2022-0018 CVSSv3 Range: 5.3 Issue Date:2022-07-12 Updated On: 2022-07-23 CVEs: CVE-2022-22982 Synopsis: VMware vCenter Server updates address a server-side request forgery vulnerability CVE-2022-22982 RSS Feed Download PDF Download Text File Share this page on social media: 1...
VMSA-2022-0019:VMware vRealize Log Insight contains multiple stored cross-site scripting vulnerabilities
Advisory ID: VMSA-2022-0019 CVSSv3 Range: 3.9 Issue Date:2022-07-12 Updated On: 2022-07-12 Initial Advisory CVEs: CVE-2022-31654, CVE-2022-31655 Synopsis: VMware vRealize Log Insight contains multiple stored cross-site scripting vulnerabilities RSS Feed Download PDF Download Text File Share this...
VMware Carbon Black App Control 8.5.x < 8.5.14 / 8.6.x < 8.6.6 / 8.7 < 8.7.4 / 8.8 < 8.8.2 Multiple Vulnerabilities (VMSA-2022-0008)
Multiple vulnerabilities exist in the VMware Carbon Black App Control management server, as follows: - VMware Carbon Black App Control 8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2 contains an OS command injection vulnerability. An authenticated, high...
Fedora: Security Advisory for golang-github-vmware-govmomi (FEDORA-2022-fae3ecee19)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Race Condition
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H...
A week in security (June 27 ā July 3)
Last week on Malwarebytes Labs: Ransomware review: June 2022 AstraLocker 2.0 ransomware isnāt going to give you your files back YTStealer targets YouTube content creators ZuoRAT is a sophisticated malware that mainly targets SOHO routers Amazon Photos vulnerability could have given attackers acce...
[SECURITY] Fedora 36 Update: golang-github-vmware-govmomi-0.24.0-5.fc36
A Go library for interacting with VMware vSphere APIs ESXi and/or vCenter...
Unknown threat groups continues to exploit Log4j in VMware Products
Threat Level Attack Report For a detailed advisory, download the pdf file here Summary An unknown APT group is exploiting the Log4j vulnerability that is affecting VMware Horizon and Unified Access Gateway UAG servers to compromise the system and take over the entire network by deploying malware...
Log4Shell Vulnerability Targeted in VMware Servers to Exfiltrate Data
The Cybersecurity and Infrastructure Security Agency CISA and Coast Guard Cyber Command CGCYBER released a joint advisory warning the Log4Shell flaw is being abused by threat actors that are compromising public-facing VMware Horizon and Unified Access Gateway UAG servers. The VMware Horizon is a...
Log4Shell Vulnerability in VMware Leads to Data Exfiltration and Ransomware
We analyzed cases of a Log4Shell vulnerability being exploited in certain versions of the software VMware Horizon. Many of these attacks resulted in data being exfiltrated from the infected systems. However, we also found that some of the victims were infected with ransomware days after the data...
CISA Log4Shell warning: Patch VMware Horizon installations immediately
CISA and the United States Coast Guard Cyber Command CGCYBER are warning that the threat of Log4Shell hasnt gone away. Its being actively exploited and used to target organisations using VMware Horizon and Unified Access Gateway servers. Log4Shell: what is it? Log4Shell was a zero-day vulnerabili...
Log4Shell Still Being Exploited to Hack VMWare Servers to Exfiltrate Sensitive Data
The U.S. Cybersecurity and Infrastructure Security Agency CISA, along with the Coast Guard Cyber Command CGCYBER, on Thursday released a joint advisory warning of continued attempts on the part of threat actors to exploit the Log4Shell flaw in VMware Horizon servers to breach target networks...
Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems
CISA and the United States Coast Guard Cyber Command CGCYBER have released a joint Cybersecurity Advisory CSA to warn network defenders that cyber threat actors, including state-sponsored advanced persistent threat APT actors, have continued to exploit CVE-2021-44228 Log4Shell in VMware HorizonĀ®...
Exploit for Expression Language Injection in Vmware Spring_Data_Mongodb
CVE-2022-22980 A local based poc of CVE-2022-22980, for the d...
Malicious code in eslint-config-vmware-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b433b08ddf72ccbb8396c9351ca1e2de9849dc8e4b66bfb49c57c54fab9fd278 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-2807 Malicious code in eslint-config-vmware-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b433b08ddf72ccbb8396c9351ca1e2de9849dc8e4b66bfb49c57c54fab9fd278 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
VMware HCX Information Disclosure Vulnerability
VMware HCX is an application mobility platform from VMware, Inc. Designed to simplify application migration, workload rebalancing and business continuity across data centers and clouds, VMware HCX versions 4.3.1 and 4.3.2 contain an information disclosure vulnerability stemming from the fact that...