Photon OS 4.0: Linux PHSA-2021-4.0-0029

An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0029. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...

Photon OS 2.0: Runc PHSA-2021-2.0-0347

An update of the runc package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0347. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc...

Photon OS 3.0: Python PHSA-2021-3.0-0239

An update of the python package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0239. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Photon OS 2.0: Cifs PHSA-2021-2.0-0344

An update of the cifs package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0344. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc...

Vmware VMware Workstation 和 Horizon Client 缓冲区错误漏洞

VMware Workstation and VMware Horizon Client are both products of Vmware, Inc.VMware Workstation is a suite of virtual machine software. VMware Workstation is a suite of virtual machine software that provides the ability to run multiple virtual machines with different operating systems at the sam...

Photon OS 3.0: Unbound PHSA-2021-3.0-0236

An update of the unbound package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0236. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Photon OS 4.0: Tmux PHSA-2021-4.0-0026

An update of the tmux package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0026. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc...

Photon OS 4.0: Wireshark PHSA-2021-4.0-0027

An update of the wireshark package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0027. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

KLA12190 Multiple vulnerabilities in VMware Workstation and VMware Player

Multiple out-of-bounds read vulnerabilities were found in VMware Workstation and VMware Player. Malicious users can exploit this vulnerability to obtain sensitive information, cause denial of service. Original advisories VMSA-2021-0009 Related products VMware-Workstation VMware-Player CVE list...

VMware vRealize Business for Cloud RCE (VMSA-2021-0007)

The version of VMware vRealize Business for Cloud running on the remote host is 7.6.x prior to 7.6.0.46000-17828140. It is, therefore, affected by a remote code execution RCE vulnerability due to an unauthorized end point. A malicious actor with network access may exploit this issue causing...

Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor

Cure53 has discovered that the Harbor web interface does not implement protection mechanisms against Cross-Site Request Forgery CSRF. By luring an authenticated user onto a prepared third-party website, an attacker can execute any action on the platform in the context of the currently authenticat...

GHSA-RFFR-C932-CPXV Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor

Cure53 has discovered that the Harbor web interface does not implement protection mechanisms against Cross-Site Request Forgery CSRF. By luring an authenticated user onto a prepared third-party website, an attacker can execute any action on the platform in the context of the currently authenticat...

SQL Injection in Cloud Native Computing Foundation Harbor

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform...

GHSA-W4X5-JQQ4-QC8X SQL Injection in Cloud Native Computing Foundation Harbor

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform...

GHSA-JR34-MFF8-PC6F SQL Injection in Cloud Native Computing Foundation Harbor

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform...

SQL Injection in Cloud Native Computing Foundation Harbor

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform...

GHSA-Q6CJ-6JVQ-JWMH Privilege Escalation in Cloud Native Computing Foundation Harbor

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform...

Privilege Escalation in Cloud Native Computing Foundation Harbor

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform...

VMSA-2021-0009:VMware Workstation and Horizon Client for Windows updates address multiple security vulnerabilities

Advisory ID: VMSA-2021-0009 CVSSv3 Range: 3.2 Issue Date:2021-05-20 Updated On: 2021-05-20 Initial Advisory CVEs: CVE-2021-21987, CVE-2021-21988, CVE-2021-21989 Synopsis: VMware Workstation and Horizon Client for Windows updates address multiple security vulnerabilities CVE-2021-21987,...

Threat spotlight: DarkSide, the ransomware used in the Colonial Pipeline attack

Late last week, the business network systems of Colonial Pipeline, the biggest supplier of fuels on the East Coast of the United States, were compromised due to a ransomware attack, forcing the company to temporarily shut down its operations while investigations are underway. Monday morning,...