VMware vRealize Automation Deserialization Vulnerability (VMSA-2018-0006)

The VMware vRealize Automation application running on the remote host is version 7.2 or 7.3 and is missing security patches indicated in the vendor advisory. It is, therefore, affected by a deserialization vulnerability. TRUSTED...

VMSA-2018-0007:VMware Virtual Appliance updates address side-channel analysis due to speculative execution

VMSA-2018-0007.6 VMware Virtual Appliance updates address side-channel analysis due to speculative execution VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2018-0007.6 VMware Security Advisory Severity: Important VMware Security Advisory Synopsis: VMware Virtual Appliance...

Can't delete replica when it is being processed.

Challenge Replication job fails with error: Can't delete replica when it is being processed. Cause If a replication job failed before the replica VM is fully created, the job may fail attempting to delete the VM as part of an undo operation on the failed run. Solution This issue can generally be...

VMware AirWatch Console HTTP Detection

Binary data vmwareairwatchconsoledetectwww.nbin...

VMware AirWatch Console 9.1.x < 9.1.5 / 9.2.x < 9.2.2 XSRF

According to its self-reported version, the install of VMware AirWatch Console running on the remote host is 9.1.x prior to 9.1.5 or 9.2.x prior to 9.2.2. It is, therefore, affected by a user-input validation error that allows cross-site request forgery XSRF attacks. Note that Nessus has not test...

Cross site request forgery (csrf)

VMware AirWatch Console 9.2.x before 9.2.2 and 9.1.x before 9.1.5 contains a Cross Site Request Forgery vulnerability when accessing the App Catalog. An attacker may exploit this issue by tricking users into installing a malicious application on their devices...

CVE-2017-4947

VMware vRealize Automation 7.3 and 7.2 and vSphere Integrated Containers 1.x before 1.3 contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote attackers to execute arbitrary code on the appliance...

CVE-2017-4951

VMware AirWatch Console 9.2.x before 9.2.2 and 9.1.x before 9.1.5 contains a Cross Site Request Forgery vulnerability when accessing the App Catalog. An attacker may exploit this issue by tricking users into installing a malicious application on their devices...

CVE-2017-4947

VMware vRealize Automation 7.3 and 7.2 and vSphere Integrated Containers 1.x before 1.3 contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote attackers to execute arbitrary code on the appliance...

Deserialization of untrusted data

VMware vRealize Automation 7.3 and 7.2 and vSphere Integrated Containers 1.x before 1.3 contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote attackers to execute arbitrary code on the appliance...

CVE-2017-4947

VMware vRealize Automation 7.3 and 7.2 and vSphere Integrated Containers 1.x before 1.3 contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote attackers to execute arbitrary code on the appliance...

CVE-2017-4951

The CVE-2017-4951 CSRF flaw affects VMware AirWatch Console in versions 9.2.x before 9.2.2 and 9.1.x before 9.1.5, caused by a user-input validation issue that enables cross-site request forgery when accessing the App Catalog. An attacker could lure an authenticated user into installing a malicio...

CVE-2017-4951

VMware AirWatch Console 9.2.x before 9.2.2 and 9.1.x before 9.1.5 contains a Cross Site Request Forgery vulnerability when accessing the App Catalog. An attacker may exploit this issue by tricking users into installing a malicious application on their devices...

CVE-2017-4947

CVE-2017-4947 describes a deserialization vulnerability via Xenon in VMware vRealize Automation (vRA) 7.2/7.3 and VIC 1.x before 1.3, allowing remote code execution on the appliance. Connected documents confirm the affected products/versions and cite mitigation via patches: vRA 7.2/7.3 require up...

VMware AirWatch Console Cross-Site Request Forgery Vulnerability

VMware AirWatch is a console application for the VMware AirWatch Console AWC, a suite of enterprise mobility management solutions from VMware, Inc. A cross-site request forgery vulnerability exists in VMware AWC versions 9.2.x and 9.1.x. The vulnerability stems from the program failing to...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of January 22, 2018

Yesterday, the Zero Day Initiative ZDI announced the dates and contest rules for Pwn2Own 2018. Last year, we celebrated the 10th anniversary of the event and the 11th year is going to be bigger than ever! Pwn2Own will be returning to Vancouver, BC, at the CanSecWest Conference on March 14-16, 201...

VMware Releases Security Updates

VMware has released security updates to address vulnerabilities in vRealize Automation, vSphere Integrated Containers, and AirWatch Console. An attacker could exploit these vulnerabilities to take control of an affected system. NCCIC/US-CERT encourages users and administrators to review the VMwar...

PT-2018-1080 · Vmware · Vsphere Integrated Containers +2

Name of the Vulnerable Software and Affected Versions: VMware vRealize Automation versions 7.2 through 7.3 vSphere Integrated Containers versions 1.x before 1.3 Description: The issue is caused by a deserialization vulnerability via Xenon, which may allow remote attackers to execute arbitrary cod...

Meltdown and Spectre Attacks | Cloud Foundry

Severity Advisory/Critical Description Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a maliciou...

Carbon Black & VMware Announce General Availability of Integrated Solution to Secure the SDDC

Securing your software-defined data center SDDC is fundamentally different than securing your end-user computers. Securing the endpoint is no longer enough - attackers have other angles they can take to wreak havoc on your system - but not securing your endpoints would be a big mistake. That’s wh...