CVE-2025-22230

CVE-2025-22230 – VMware Tools for Windows is affected by an authentication bypass due to improper access control. A non-administrative user on a guest VM may abuse this to perform high-privilege operations within the VM. Affected versions include VMware Tools 11.x and 12.x before 12.5.1; remediat...

CVE-2025-22230 Authentication bypass vulnerability

VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges on a guest VM may gain ability to perform certain high privilege operations within that VM...

VMware Tools for Windows 安全漏洞

VMware Tools for Windows is a suite of Windows-based enhancement tools from VMware that come with VMWare virtual machines, and it is a driver provided by VMware to enhance the performance of virtual graphics cards and hard disks, as well as to synchronize the clocks of the virtual machine with th...

VMSA-2025-0005: VMware Tools for Windows update addresses an authentication bypass vulnerability (CVE-2025-22230)

Advisory ID: | VMSA-2025-0005 ---|--- Advisory Severity: | Important CVSSv3 Range: | 7.8 Synopsis: | VMware Tools for Windows update addresses an authentication bypass vulnerability CVE-2025-22230 Issue date: | 2025-03-25 Updated on: | 2025-03-25 Initial Advisory CVEs | CVE-2025-22230 1. Impacted...

PT-2025-12803

Name of the Vulnerable Software and Affected Versions VMware Tools for Windows versions 11.x.x through 12.x.x Description VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges on a guest VM may...

VMware Spring Security 安全漏洞

VMware Spring Security is a set of security frameworks from VMware, Inc. that provide illustrative security protection for Spring-based applications. A security vulnerability exists in VMware Spring Security versions 6.4.0 through 6.4.3 that originates from an authorization bypass...

The vulnerability of the VMware Aria Automation (formerly vRealize Automation) automation software and the VMware Cloud Foundation virtualization platform, related to insufficient validation of incoming requests, allows a attacker to perform an SSRF attack.

The vulnerability of the VMware Aria Automation formerly vRealize Automation and VMware Cloud Foundation virtualization platform lies in the insufficient verification of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack by sending a specially...

PVS Server SOAP service communication fails from remote PVS console

When setting up new Windows Server 2025 virtual machines on VMware to create two new PVS servers, the following issues occur: After installing PVS software and running configuration wizard successfully on the first PVS server, the PVS farm access using this PVS server was only possible using the...

Photon OS 4.0: Linux PHSA-2025-4.0-0771

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0771. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

VMware Spring Security 安全漏洞

VMware Spring Security is a set of security frameworks from VMware, Inc. that provide illustrative security for Spring-based applications. A security vulnerability exists in VMware Spring Security that stems from incorrectly returning true for passwords longer than 72 characters...

CISA Releases Seven Industrial Control Systems Advisories

CISA released seven Industrial Control Systems ICS advisories on March 18, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-077-01 Schneider Electric EcoStruxure Power Automation System User Interface EPAS-UI...

Akira Ransomware Bruteforcer

This tool helps decrypt encrypted files from Akira Ransomware Linux/ESXI variant 2024 using a bunch of GPUs...

Photon OS 4.0: Binutils PHSA-2025-4.0-0767

An update of the binutils package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0767. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-21862 drop_monitor: fix incorrect initialization order

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix incorrect initialization order Syzkaller reports the following bug: BUG: spinlock bad magic on CPU1, syz-executor.0/7995 lock: 0xffff88805303f3e0, .magic: 00000000, .owner: /-1, .ownercpu: 0 CPU: 1 PID: 7995 Comm...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver bsc1203332. CVE-2022-48742: rtnetlink: make sure to refresh masterdev/mops in...

VMware vCenter Server 8.0.2 Privilege Escalation

VMware vCenter Server version 8.0.2 proof of concept privilege escalation exploit that leverages a vulnerability from 2024. ============================================================================================================================================= | Title : VMware vCenter Server...

Photon OS 4.0: Rubygem PHSA-2025-4.0-0765

An update of the rubygem package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0765. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 4.0: Gettext PHSA-2025-4.0-0765

An update of the gettext package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0765. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Rubygem PHSA-2025-5.0-0485

An update of the rubygem package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0485. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-22226

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process...