CVE-2021-22002

CVE-2021-22002 affects VMware Workspace ONE Access and Identity Manager. The flaw allows tampering with host headers to access the /cfg web app and diagnostic endpoints over port 443, bypassing authentication for those resources. The root cause is improper validation of host headers that enables ...

CVE-2021-22002: Improper Authentication

VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in...

CVE-2021-22003: Improper Restriction of Excessive Authentication Attempts

VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and...

CVE-2021-22029: Allocation of Resources Without Limits or Throttling

VMware Workspace ONE UEM REST API contains a denial of service vulnerability. A malicious actor with access to /API/system/admins/session could cause an API denial of service due to improper rate limiting...

PT-2021-4672

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE UEM affected versions not specified Description The issue is related to a denial of service vulnerability in the VMware Workspace ONE UEM REST API, caused by improper rate limiting in the endpoint. This could allow a remot...

VulnCheck KEV: CVE-2022-22972

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate...

PT-2021-3779

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE Access and Identity Manager affected versions not specified VMware Identity Manager affected versions not specified vRealize Automation affected versions not specified Cloud Foundation affected versions not specified...

PT-2021-3778

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE Access and Identity Manager affected versions not specified Description The issue is related to the unintentional provision of a login interface on port 7443, which may allow a malicious actor with network access to attemp...

VMSA-2021-0016:VMware Workspace ONE Access, Identity Manager and vRealize Automation address multiple vulnerabilities

Advisory ID: VMSA-2021-0016.2 CVSSv3 Range: 3.7-8.6 Issue Date:2021-08-05 Updated On: 2021-11-12 CVEs: CVE-2021-22002, CVE-2021-22003 Synopsis: VMware Workspace ONE Access, Identity Manager and vRealize Automation address multiple vulnerabilities CVE-2021-22002, CVE-2021-22003 RSS Feed Download P...

Workspace ONE Intelligent Hub 20.3.8.0 - (VMware Hub Health Monitoring Service) Unquoted Service Pat

Exploit Title: Workspace ONE Intelligent Hub 20.3.8.0 - 'VMware Hub Health Monitoring Service' Unquoted Service Path Discovery by: Ismael Nava Vendor Homepage: https://www.vmware.com/mx/products/workspace-one/intelligent-hub.html Software Links : https://getwsone.com/ Tested Version: 20.3.8.0...

Workspace ONE Intelligent Hub 20.3.8.0 - 'VMware Hub Health Monitoring Service' Unquoted Service Path

Exploit Title: Workspace ONE Intelligent Hub 20.3.8.0 - 'VMware Hub Health Monitoring Service' Unquoted Service Path Discovery by: Ismael Nava Discovery Date: 06-16-2021 Vendor Homepage: https://www.vmware.com/mx/products/workspace-one/intelligent-hub.html Software Links : https://getwsone.com/...

VMware Workspace One Web Page Structure

The vulnerability of VMware Workspace One’s software products exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

CVE-2021-21990

VMware Workspace one UEM console 2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior to 20.10.0.16,2008 prior to 20.8.0.28, 2007 prior to 20.7.0.14,2006 prior to 20.6.0.19, 2005 prior to 20.5.0.46, 2004 prior to 20.4.0.21, 2003 prior to 20.3.0.23, 2001 prior to...

CVE-2021-21990

The CVE-2021-21990 entry describes a cross-site scripting (XSS) vulnerability in VMware Workspace ONE UEM Console. Affected versions (as listed in the CVE) include multiple 20.x/19.x lines (various build numbers) prior to the specified fixed releases. Root cause: the console does not validate inc...

CVE-2021-21990: Improper Neutralization of Input During Web Page Generation

VMware Workspace one UEM console 2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior to 20.10.0.16,2008 prior to 20.8.0.28, 2007 prior to 20.7.0.14,2006 prior to 20.6.0.19, 2005 prior to 20.5.0.46, 2004 prior to 20.4.0.21, 2003 prior to 20.3.0.23, 2001 prior to...

PT-2021-3249

Name of the Vulnerable Software and Affected Versions VMware Workspace One versions 20.1.0.0 through 20.1.0.31 VMware Workspace One versions 20.3.0.0 through 20.3.0.22 VMware Workspace One versions 20.4.0.0 through 20.4.0.20 VMware Workspace One versions 20.5.0.0 through 20.5.0.45 VMware Workspac...

Vmware Workspace One 跨站脚本漏洞

Vmware Vmware Workspace One is a platform for supporting cross-device applications for rapid delivery and management of applications from Vmware, USA. The platform, which includes VMware Horizon and VMware Horizon Cloud, integrates access control, application management, and multi-platform endpoi...

VMware Workspace ONE Access HTTP Detection

Binary data vmwareworkspaceoneaccesswebdetect.nbin...

VMware Workspace One Access / VMware Identity Manager Command Injection Vulnerability (VMSA-2020-0027)

The VMware Workspace One Access formerly VMware Identity Manager application running on the remote host is affected by a unspecified command injection vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version. C Tenable...

NSA Releases Advisory on Russian State-Sponsored Malicious Cyber Actors Exploiting CVE-2020-4006

The National Security Agency NSA has released a Cybersecurity Advisory on Russian state-sponsored actors exploiting CVE-2020-4006, a command-injection vulnerability in VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. The actors were found exploiting...