Photon OS 2.0: Binutils PHSA-2021-2.0-0321

An update of the binutils package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0321. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2020-28972

SaltStack Salt CVE-2020-28972 : A vulnerability in Salt before 3002.5 allows authentication to VMware vcenter, vSphere, and ESXi servers via the vmware.py code paths without always validating SSL/TLS certificates. The issue stems from improper certificate validation in the SSL/TLS verification fl...

Saltstack SaltStack Salt 信任管理问题漏洞

SaltStack Salt is a set of open source tools for managing infrastructure from SaltStack Saltstack. The tool provides configuration management, remote execution, and other features. A security vulnerability exists in SaltStack Salt versions prior to Salt 3002.5, which stems from the fact that...

Exploit for Path Traversal in Vmware Cloud_Foundation

vsphereyeeter.sh is an automated bash script to exploit vuln...

Exploit for Path Traversal in Vmware Cloud_Foundation

Usage & Disclaimer VMware vCenter Server Remote Code Executi...

Exploit for Path Traversal in Vmware Cloud_Foundation

VMwarevCenterUNAuthorizedRCECVE-2021-21972 zoomeye do...

Exploit for Path Traversal in Vmware Cloud_Foundation

CVE-2021-21972 Description The vSphere Client HTML5 co...

Exploit for Path Traversal in Vmware Cloud_Foundation

CVE-2021-21972 checker VMware vCenter Server CVE-2021-21972...

VulnCheck KEV: CVE-2021-21973

VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure...

VMware vCenter Server 6.5 / 6.7 / 7.0 Multiple Vulnerabilities (VMSA-2021-0002)

The version of VMware vCenter Server installed on the remote host is 6.5 prior to 6.5 U3n, 6.7 prior to 6.7 U3l or 7.0 prior to 7.0 U1c. It is, therefore, affected by multiple vulnerabilities, as follows: - The vSphere Client HTML5 contains a remote code execution vulnerability in a vCenter Serve...

VMware VCenter Server file upload

Added: 02/25/2021 Background VMware VCenter Server is server management software for controlling VMware VSphere environments. Problem A vulnerability in VMware VCenter Server allows remote, unauthenticated attackers to upload files to arbitrary locations on the server, leading to command executio...

VMware VCenter Server file upload

Added: 02/25/2021 Background VMware VCenter Server is server management software for controlling VMware VSphere environments. Problem A vulnerability in VMware VCenter Server allows remote, unauthenticated attackers to upload files to arbitrary locations on the server, leading to command executio...

ESXi 6.5 / 6.7 / 7.0 RCE (VMSA-2021-0002)

The remote VMware ESXi host is version 6.5, 6.7 or 7.0 and is affected by a remote code execution vulnerability. OpenSLP as used in ESXi 7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG has a heap-overflow vulnerability. A malicious actor residing...

VMware vCenter Server RCE (direct check)

Binary data vmwarevcentercve-2021-21972.nbin...

Photon OS 1.0: Binutils PHSA-2021-1.0-0362

An update of the binutils package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-1.0-0362. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

VMware VCenter Server file upload

Added: 02/25/2021 Background VMware VCenter Server is server management software for controlling VMware VSphere environments. Problem A vulnerability in VMware VCenter Server allows remote, unauthenticated attackers to upload files to arbitrary locations on the server, leading to command executio...

The vulnerability of the vSphere Client plugin for managing VMware vCenter Server allows a hacker to execute arbitrary code.

The vulnerability of the vSphere Client plugin for managing VMware vCenter Server lies in insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted HTTP request remotely...

VMware vCenter Server CVE-2021-21972 Remote Code Execution Vulnerability: What You Need to Know

This blog post was co-authored by Bob Rudis and Caitlin Condon. What’s up? On Feb. 23, 2021, VMware published an advisory VMSA-2021-0002 describing three weaknesses affecting VMware ESXi, VMware vCenter Server, and VMware Cloud Foundation. Before digging into the individual vulnerabilities, it is...

CVE-2021-21974

OpenSLP as used in ESXi 7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue i...

CVE-2021-21973

The vSphere Client HTML5 contains an SSRF Server Side Request Forgery vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information...