VMware vRealize Business for Cloud RCE (VMSA-2021-0007)

The version of VMware vRealize Business for Cloud running on the remote host is 7.6.x prior to 7.6.0.46000-17828140. It is, therefore, affected by a remote code execution RCE vulnerability due to an unauthorized end point. A malicious actor with network access may exploit this issue causing...

Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor

Cure53 has discovered that the Harbor web interface does not implement protection mechanisms against Cross-Site Request Forgery CSRF. By luring an authenticated user onto a prepared third-party website, an attacker can execute any action on the platform in the context of the currently authenticat...

GHSA-RFFR-C932-CPXV Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor

Cure53 has discovered that the Harbor web interface does not implement protection mechanisms against Cross-Site Request Forgery CSRF. By luring an authenticated user onto a prepared third-party website, an attacker can execute any action on the platform in the context of the currently authenticat...

SQL Injection in Cloud Native Computing Foundation Harbor

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform...

GHSA-W4X5-JQQ4-QC8X SQL Injection in Cloud Native Computing Foundation Harbor

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform...

SQL Injection in Cloud Native Computing Foundation Harbor

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform...

GHSA-JR34-MFF8-PC6F SQL Injection in Cloud Native Computing Foundation Harbor

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform...

Privilege Escalation in Cloud Native Computing Foundation Harbor

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform...

GHSA-Q6CJ-6JVQ-JWMH Privilege Escalation in Cloud Native Computing Foundation Harbor

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform...

VMSA-2021-0009:VMware Workstation and Horizon Client for Windows updates address multiple security vulnerabilities

Advisory ID: VMSA-2021-0009 CVSSv3 Range: 3.2 Issue Date:2021-05-20 Updated On: 2021-05-20 Initial Advisory CVEs: CVE-2021-21987, CVE-2021-21988, CVE-2021-21989 Synopsis: VMware Workstation and Horizon Client for Windows updates address multiple security vulnerabilities CVE-2021-21987,...

Threat spotlight: DarkSide, the ransomware used in the Colonial Pipeline attack

Late last week, the business network systems of Colonial Pipeline, the biggest supplier of fuels on the East Coast of the United States, were compromised due to a ransomware attack, forcing the company to temporarily shut down its operations while investigations are underway. Monday morning,...

CVE-2021-21990

VMware Workspace one UEM console 2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior to 20.10.0.16,2008 prior to 20.8.0.28, 2007 prior to 20.7.0.14,2006 prior to 20.6.0.19, 2005 prior to 20.5.0.46, 2004 prior to 20.4.0.21, 2003 prior to 20.3.0.23, 2001 prior to...

Cross site scripting

VMware Workspace one UEM console 2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior to 20.10.0.16,2008 prior to 20.8.0.28, 2007 prior to 20.7.0.14,2006 prior to 20.6.0.19, 2005 prior to 20.5.0.46, 2004 prior to 20.4.0.21, 2003 prior to 20.3.0.23, 2001 prior to...

CVE-2021-21990

VMware Workspace one UEM console 2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior to 20.10.0.16,2008 prior to 20.8.0.28, 2007 prior to 20.7.0.14,2006 prior to 20.6.0.19, 2005 prior to 20.5.0.46, 2004 prior to 20.4.0.21, 2003 prior to 20.3.0.23, 2001 prior to...

CVE-2021-21990

The CVE-2021-21990 entry describes a cross-site scripting (XSS) vulnerability in VMware Workspace ONE UEM Console. Affected versions (as listed in the CVE) include multiple 20.x/19.x lines (various build numbers) prior to the specified fixed releases. Root cause: the console does not validate inc...

Vmware Workspace One 跨站脚本漏洞

Vmware Vmware Workspace One is a platform for supporting cross-device applications for rapid delivery and management of applications from Vmware, USA. The platform, which includes VMware Horizon and VMware Horizon Cloud, integrates access control, application management, and multi-platform endpoi...

VMware Workspace ONE UEM console patches address a cross-site scripting vulnerability (CVE-2021-21990)

3. Cross Site Scripting XSS vulnerability in VMware Workspace ONE UEM console CVE-2021-21990 VMware Workspace ONE UEM console does not validate an incoming request during device enrollment.VMware has evaluated the severity of this issue to be in the low severity range with a maximum CVSSv3 base...

VMware vRealize Business for Cloud Command Injection Vulnerability

Vmware vRealize Business for Cloud is a software application from Vmware, Inc. It provides an automated way to perform cloud cost analysis, consumption metrics, and cloud comparison and planning, as well as providing cost visibility and business insight so that cloud functions can be run more...

CVE-2021-21984

VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthorised end point. A malicious actor with network access may exploit this issue causing unauthorised remote code execution on vRealize Business for Cloud Virtual Appliance...

Remote code execution

VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthorised end point. A malicious actor with network access may exploit this issue causing unauthorised remote code execution on vRealize Business for Cloud Virtual Appliance...