The vulnerability of the VMware Horizon workstation virtualization system’s server allows attackers to carry out cross-site scripting attacks.

The vulnerability of the VMware Horizon workstation virtualization system server is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to perform domain-joining attacks...

VMware ESXi, Workstation and Fusion updates address use-after-free and privilege escalation vulnerabilities (CVE-2020-4004, CVE-2020-4005)

3a. Use-after-free vulnerability in XHCI USB controller CVE-2020-4004 VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9....

VMWare SD-WAN Orchestrator SQL Injection Vulnerability

Vmware VMWare SD-WAN Orchestrator is a software from Vmware that orchestrates network data flows in a software-defined network architecture. The software provides Web pages to visualize and manage users, gateways, and authentication. An SQL injection vulnerability exists in VMware SD-WAN...

KLA12101 Use after free vulnerability in VMware Workstation and Player

A use after free vulnerability was found in VMware Workstation and Player. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories VMSA-2020-0026 Related products VMware-Workstation VMware-Player CVE list CVE-2020-4004 critical Solution Update to the latest...

Vmware VMWare SD-WAN Orchestrator SQL注入漏洞

VMware VMWare SD-WAN Orchestrator is a software for orchestrating network data flows in a software-defined network architecture. A SQL injection vulnerability exists in VMware VMWare SD-WAN Orchestrator, which can be exploited by a remote attacker to submit a special SQL request to manipulate a...

Vmware VMWare SD-WAN Orchestrator Authorization Issues Vulnerability

Vmware VMWare SD-WAN Orchestrator is a software from Vmware that orchestrates network data flows in a software-defined network architecture. The software provides Web pages to visually manage users, gateways, and authentication. An authorization issue vulnerability exists in VMware SD-WAN...

Vmware VMWare SD-WAN Orchestrator Input Validation Error Vulnerability

Vmware VMWare SD-WAN Orchestrator is a software from Vmware that orchestrates network data flows in a software-defined network architecture. The software provides Web pages to visualize and manage users, gateways, and authentication. An input validation error vulnerability exists in VMware SD-WAN...

VMware Carbon Black Announces Splunk Integration to Streamline and Modernize SOC Workflows

Introducing Unified VMware Carbon Black Cloud App for Splunk At VMware Carbon Black, our ecosystem of integration and alliance partners has been a core part of our vision and strategy. Today, with thousands of customers adopting the VMware Carbon Black Cloud to secure their endpoints and workload...

fence security update

CentOS Errata and Security Advisory CESA-2020:5003 An update for fence-agents is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

VMware SD-WAN Orchestrator updates address multiple security vulnerabilities (CVE-2020-3984, CVE-2020-3985, CVE-2020-4000, CVE-2020-4001, CVE-2020-4002 ,CVE-2020-4003)

3a. SQL injection vulnerability due to improper input validation CVE-2020-3984 The SD-WAN Orchestrator does not apply correct input validation which allows for SQL-injection. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of...

Photon OS 2.0: Ruby PHSA-2020-2.0-0295

An update of the ruby package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0295. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid142988;...

Photon OS 2.0: Apache PHSA-2020-2.0-0295

An update of the apache package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0295. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid14298...

Photon OS 2.0: Pam_Tacplus PHSA-2020-2.0-0295

An update of the pamtacplus package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0295. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 2.0: Python3 PHSA-2020-2.0-0295

An update of the python3 package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0295. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

VMSA-2020-0026:VMware ESXi, Workstation and Fusion updates address use-after-free and privilege escalation vulnerabilities

Advisory ID: VMSA-2020-0026.1 CVSSv3 Range: 8.8 - 9.3 Issue Date:2020-11-19 Updated On: 2020-11-24 CVEs: CVE-2020-4004, CVE-2020-4005 Synopsis: VMware ESXi, Workstation and Fusion updates address use-after-free and privilege escalation vulnerabilities CVE-2020-4004, CVE-2020-4005 RSS Feed Downloa...

VMware ESXi OpenSLP Remote Code Execution Vulnerability (CVE-2020-3992 and CVE-2019-5544): What You Need To Know

What’s up? On November 6, 2020 Microsoft’s Kevin Beaumont alerted the community to evidence of active exploitation attempts of CVE-2020-3992 and/or CVE-2019-5544, which are remote code execution RCE vulnerabilities in VMware ESXi’s service location protocol SLP service. VMware had issued a patch...

VulnCheck KEV: CVE-2020-3992

VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution...

VulnCheck KEV: CVE-2019-5544

VMware ESXi and Horizon Desktop as a Service DaaS OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution...

Photon OS 3.0: Linux PHSA-2020-3.0-0160

An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0160. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid142656;...

Photon OS 3.0: Libarchive PHSA-2020-3.0-0160

An update of the libarchive package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0160. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid142658;...