Critical Bug in VMWare Carbon Black Allows Takeover

A critical security vulnerability in the VMware Carbon Black Cloud Workload appliance would allow privilege escalation and the ability to take over the administrative rights for the solution. The bug CVE-2021-21982 ranks 9.1 out of 10 on the CVSS vulnerability-severity scale. The VMware Carbon...

Exploit for Path Traversal in Vmware Cloud_Foundation

CVE-2021-21972 VMware vSphere Client Unauthorized File Upload...

Exploit for Server-Side Request Forgery in Vmware Cloud_Foundation

CVE-2021-21975 VMware vRealize Operations Manager API Server S...

Vmware Carbon Black Cloud Authentication Bypass Vulnerability

Vmware Carbon Black Cloud is a Sass platform from Vmware USA that provides security checking and defense capabilities for cloud endpoints. VMware Carbon Black Cloud Workload 1.0.1 and prior versions have an authentication bypass vulnerability that could allow a user with network access to the...

VMware vRealize Operations Arbitrary File Write Vulnerability

VMware vRealize Operations is an application from vmware, Inc. A unified, AI-based platform for private, hybrid and multi-cloud environments that delivers IT operations management on autopilot. An arbitrary file write vulnerability exists in the vRealize Operations Manager API prior to version 8....

F5 iControl Server-Side Request Forgery / Remote Command Execution Exploit

This Metasploit module exploits a pre-authentication server-side request forgery vulnerability in the F5 iControl REST API's /mgmt/shared/authn/login endpoint to generate an X-F5-Auth-Token that can be used to execute root commands on an affected BIG-IP or BIG-IQ device. This module requires...

VMware Releases Security Update

VMware has released a security update to address a vulnerability in VMware Carbon Black Cloud Workload appliance. A remote attacker could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review VMware Security Advisory VMSA-2021-005 and...

VMware vRealize Operations Server-Side Request Forgery Vulnerability

VMware vRealize Operations is an application from vmware, Inc. A unified, AI-based platform for private, hybrid and multi-cloud environments that delivers IT operations management on autopilot. A server-side request forgery vulnerability in the VMware vRealize Operations Manager API prior to...

CVE-2021-21982

VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor with network access to the administrative interface of the VMware Carbon Black Cloud Workload appliance to obtain a valid authentication token. Successful...

Authentication flaw

VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor with network access to the administrative interface of the VMware Carbon Black Cloud Workload appliance to obtain a valid authentication token. Successful...

CVE-2021-21982

VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor with network access to the administrative interface of the VMware Carbon Black Cloud Workload appliance to obtain a valid authentication token. Successful...

CVE-2021-21982

Summary: CVE-2021-21982 affects the VMware Carbon Black Cloud Workload appliance (versions 1.0.0 and 1.0.1) and is an authentication bypass vulnerability. A malicious actor with network access to the appliance’s administrative interface can obtain a valid authentication token and, as a result, vi...

Vmware Carbon Black Cloud 授权问题漏洞

Vmware Carbon Black Cloud is a Sass platform from Vmware USA that provides security checking and defense capabilities for cloud endpoints. VMware Carbon Black Cloud Workload 1.0.1 and prior versions have an authentication bypass vulnerability that could allow a user with network access to the...

Photon OS 3.0: Nodejs PHSA-2021-3.0-0213

An update of the nodejs package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0213. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid148292;...

Photon OS 1.0: Linux PHSA-2021-1.0-0375

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-1.0-0375. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid148294...

VMware Carbon Black Cloud Workload appliance update addresses incorrect URL handling vulnerability (CVE-2021-21982)

3. Advisory Details A URL on the administrative interface of the VMware Carbon Black Cloud Workload appliance can be manipulated to bypass authentication. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.1...

Photon OS 3.0: Glibc PHSA-2021-3.0-0214

An update of the glibc package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0214. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid148285...

Linux Distribution Coverage Extended Across the VMware Carbon Black Cloud

In 2020, a record 56 new Linux malware families were discovered. We are now seeing this trend continue into the new year with the latest discovery of RedXOR, believed to be formulated by Chinese nation-state actors targeting RedHat Enterprise Linux RHEL. With organizations hyper-accelerating thei...

Exploit for Server-Side Request Forgery in Vmware Cloud_Foundation

CVE-2021-21975 SSRF-POC - ssrf to cred leak First configur...

VMware vRealize Operations Manager SSRF和文件读取漏洞（CVE-2021-21975 CVE-2021-21983）

Description On March 30, 2021, VMware published a security advisory for CVE-2021-21975 and CVE-2021-21983, two chainable vulnerabilities in its vRealize Operations Manager product. CVE-2021-21975 is an unauthenticated server-side request forgery SSRF, while CVE-2021-21983 is an authenticated...