Photon OS 3.0: Containerd PHSA-2020-3.0-0155

An update of the containerd package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0155. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid141867;...

CVE-2020-3997

VMware Horizon Server 7.x prior to 7.10.3 or 7.13.0 contains a Cross Site Scripting XSS vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed...

CVE-2020-3997

VMware Horizon Server 7.x prior to 7.10.3 or 7.13.0 contains a Cross Site Scripting XSS vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed...

CVE-2020-3998

VMware Horizon Client for Windows 5.x prior to 5.5.0 contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed may be able to retrieve hashed credentials if the client crashes...

Information disclosure

VMware Horizon Client for Windows 5.x prior to 5.5.0 contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed may be able to retrieve hashed credentials if the client crashes...

Cross site scripting

VMware Horizon Server 7.x prior to 7.10.3 or 7.13.0 contains a Cross Site Scripting XSS vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed...

CVE-2020-3998

VMware Horizon Client for Windows 5.x prior to 5.5.0 contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed may be able to retrieve hashed credentials if the client crashes...

CVE-2020-3998

CVE-2020-3998 affects VMware Horizon Client for Windows versions prior to 5.5.0. The vulnerability is an information-disclosure flaw in the Horizon Client on Windows where a malicious local user can retrieve hashed credentials if the client crashes. Affected software: Horizon Client for Windows (...

CVE-2020-3997

VMware Horizon Server 7.x prior to 7.10.3 or 7.13.0 contains a Cross Site Scripting XSS vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed...

CVE-2020-3997

CVE-2020-3997 is a Cross Site Scripting (XSS) vulnerability in VMware Horizon Server (affecting 7.x prior to 7.10.3 or 7.13.0). VMware describes that the server does not correctly validate user input, allowing an attacker to inject and execute malicious scripts. The issue is addressed in VMware’s...

Photon OS 1.0: Envoy PHSA-2020-1.0-0335

An update of the envoy package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0335. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid141859...

Vulnerabilities fixed in VMware Horizon Server and Client

Vulnerabilities have been fixed in VMware Horizon Server and Client. The vulnerabilities allow a malicious party to access system data and to execute arbitrary code under the user's privileges. VMware has released updates to fix the vulnerabilities. More information can be found on the page below...

VMware Horizon View Client < 5.5.0 DoS (VMSA-2020-0022)

The version of VMware Horizon Client for Windows installed on the remote host is less than 5.5.0. It is, therefore, affected by a denial of service DoS vulnerability due to a file system access control issue during install time. An unauthenticated, local attacker can exploit this, via symbolic...

VMware Horizon Server and VMware Horizon Client updates address multiple security vulnerabilities (CVE-2020-3997, CVE-2020-3998)

3a. VMware Horizon Server Cross Site Scripting XSS vulnerability CVE-2020-3997 VMware Horizon Server does not correctly validate user input. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.1. 3b. VMware Horizon Client for...

The vulnerability of software for deploying virtual computers and Vmware Horizon DaaS applications allows attackers to bypass the two-factor authentication process.

The vulnerability of the software for deploying virtual computers and Vmware Horizon DaaS applications is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a malicious actor to bypass the two-factor authentication process...

Photon OS 2.0: Oniguruma PHSA-2020-2.0-0291

An update of the oniguruma package has been released. File data PhotonOSPHSA-2020-20-0291oniguruma.nasl...

Photon OS 1.0: Elasticsearch PHSA-2020-1.0-0321

An update of the elasticsearch package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0321. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 1.0: Postgresql PHSA-2020-1.0-0321

An update of the postgresql package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0321. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 1.0: Kibana PHSA-2020-1.0-0321

An update of the kibana package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0321. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid14163...

VMSA-2020-0023 : VMware ESXi, Workstation, Fusion and NSX-T updates address multiple security vulnerabilities

a. ESXi OpenSLP remote code execution vulnerability CVE-2020-3992 OpenSLP as used in ESXi has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remo...