The vulnerability in the web application of the logupload software for load testing infrastructure in Virtual PC environments via VMware View Planner allows a perpetrator to execute arbitrary code.

The vulnerability of the web application logupload feature of the VMware View Planner software, a load testing infrastructure for virtual PCs, is related to the absence of authentication and improper input validation. Exploiting this vulnerability allows an attacker to execute arbitrary code...

VMware vRealize Operations (vROps) Manager SSRF RCE

This module exploits a pre-auth SSRF CVE-2021-21975 and post-auth file write CVE-2021-21983 in VMware vRealize Operations Manager to leak admin creds and write/execute a JSP payload. CVE-2021-21975 affects the /casa/nodes/thumbprints endpoint, and CVE-2021-21983 affects the...

VMware vRealize Operations updates address Server Side Request Forgery and Arbitrary File Write vulnerabilities (CVE-2021-21975, CVE-2021-21983)

1. Impacted Products VMware vRealize Operations VMware Cloud Foundation vRealize Suite Lifecycle Manager 2. Introduction Multiple vulnerabilities in VMware vRealize Operations were privately reported to VMware. Patches and Workarounds are available to address these vulnerabilities in impacted...

VMware vRealize Operations updates address Server Side Request Forgery and Arbitrary File Write vulnerabilities (CVE-2021-21975, CVE-2021-21983)

3a. Server Side Request Forgery in vRealize Operations Manager API CVE-2021-21975 The vRealize Operations Manager API contains a Server Side Request Forgery. VMware has evaluated this issue to be of 'Important' severity with a maximum CVSSv3 base score of 8.6. 3b. Arbitrary file write vulnerabili...

Women in Security Part 6: Meet Nandini De, Director of Engineering

This post is part of our Women’s History Month series - follow along with us on Twitter @VMwareCarbonBlack To conclude Women’s History Month, we are thrilled to bring you the last spotlight of our Women in Security series. It’s been an honor to highlight the outstanding women in the VMware Securi...

VMSA-2021-0004:VMware vRealize Operations updates address Server Side Request Forgery and Arbitrary File Write vulnerabilities

Advisory ID: VMSA-2021-0004.2 CVSSv3 Range: 7.2 - 8.6 Issue Date:2021-03-30 Updated On: 2021-08-24 CVEs: CVE-2021-21975, CVE-2021-21983 Synopsis: VMware vRealize Operations updates address Server Side Request Forgery and Arbitrary File Write vulnerabilities CVE-2021-21975, CVE-2021-21983 RSS Feed...

Photon OS 3.0: Linux PHSA-2021-3.0-0210

An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0210. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid148189;...

Photon OS 3.0: Containerd PHSA-2021-3.0-0210

An update of the containerd package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0210. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid148190;...

VMware vCenter Server Detection Consolidation

Consolidation of VMware vCenter Server detections. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only include"pluginfeedinfo.inc"; ifdescription...

Photon OS 2.0: Nxtgn PHSA-2021-2.0-0331

An update of the nxtgn package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0331. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid148186...

Photon OS 3.0: Nxtgn PHSA-2021-3.0-0210

An update of the nxtgn package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0210. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid148192;...

Photon OS 3.0: Libtiff PHSA-2021-3.0-0210

An update of the libtiff package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0210. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid148191;...

Women in Security Part 5: Meet Lavine Oluoch, Threat Analyst

This post is part of our Women’s History Month series - follow along with us on Twitter @VMwareCarbonBlack In continued celebration of Women’s History Month, we are excited to bring you our next featured security expert as a part of our six-part Women in Security series. Throughout March, we are...

Photon OS 4.0: Grub2 PHSA-2021-4.0-0001

An update of the grub2 package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0001. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid148024;...

Photon OS 4.0: C PHSA-2021-4.0-0006

An update of the c package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0006. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid148027; scriptversion"1.7";...

Women in Security Part 4: Meet Jan Lawford, Senior Director of EMEA Security Sales

This post is part of our Women’s History Month series - follow along with us on Twitter @VMwareCarbonBlack As we continue to celebrate Women’s History Month, we are honored to share the stories of women in our VMware Security Business Unit, including members of our team and customers alike. By...

Photon OS 2.0: Envoy PHSA-2021-2.0-0326

An update of the envoy package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0326. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid147949...

Photon OS 2.0: Glibc PHSA-2021-2.0-0329

An update of the glibc package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0329. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid147951...

Photon OS 3.0: Apache PHSA-2021-3.0-0208

An update of the apache package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0208. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid147953;...

Weekly exploit digest – March, 15-21 – VMware View Planner, Win32k ConsoleControl, Microsoft Windows Containers DP API

Welcome to our weekly exploit digest! We should say this hasnt been a big week because guys keep producing exploits for the vulnerabilities discovered in the 1st half of March. Nevertheless, we have some new good arrivals for VMware, MS Windows and Win32 to talk about. New 4+ scored exploits have...