CVE-2020-4003

CVE-2020-4003 affects VMware SD-WAN Orchestrator, with versions 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1; it is a SQL injection flaw that allows an authenticated SD-WAN Orchestrator user to inject code into SQL queries and potentially disclose information. The CVE i...

CVE-2020-4003

VMware SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 was found to be vulnerable to SQL-injection attacks allowing for potential information disclosure. An authenticated SD-WAN Orchestrator user may inject code into SQL queries which may lead to...

Critical Unpatched VMware Flaw Affects Multiple Corporates Products

VMware has released temporary workarounds to address a critical vulnerability in its products that could be exploited by an attacker to take control of an affected system. "A malicious actor with network access to the administrative configurator on port 8443 and a valid password for the...

Critical Unpatched VMware Flaw Affects Multiple Corporates Products

VMware has released temporary workarounds to address a critical vulnerability in its products that could be exploited by an attacker to take control of an affected system. "A malicious actor with network access to the administrative configurator on port 8443 and a valid password for the...

Vulnerabilities in VMware products

There is a vulnerability in a number of VMware products. The vulnerability allows a malicious person with access to the administrative configurator on port 8443 and valid admin credentials for this remote configurator to execute arbitrary commands with elevated privileges to execute arbitrary...

Photon OS 3.0: Linux PHSA-2020-3.0-0163

An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0163. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid143248;...

VMware Workstation 15.x < 15.5.7 Use-after-free (VMSA-2020-0026)

The version of VMware Workstation installed on the remote Windows host is 15.x prior to 15.5.7. It is, therefore, affected by a use-after-free error in the XHCI USB Controller. An unauthenticated, local attacker with administrative privileges on a virtual machine may exploit this issue to execute...

Photon OS 2.0: Tcpdump PHSA-2020-2.0-0297

An update of the tcpdump package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0297. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

VMware Fusion 11.x < 11.5.7 Use-after-free (VMSA-2020-0026)

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 11.x prior to 11.5.7. It is, therefore, affected by a use-after-free error in the XHCI USB Controller. An unauthenticated, local attacker with administrative privileges on a virtual machine may exploit this issue to...

CVE-2020-4006

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability...

CVE-2020-4006

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability...

Command injection

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability...

Critical VMware Zero-Day Bug Allows Command Injection; Patch Pending

The U.S. Cybersecurity and Infrastructure Security Agency is warning of a zero-day bug affecting six VMware products including its Workspace One, Identity Manager and vRealize Suite Lifecycle Manager. The critical unpatched bug is a command injection vulnerability. In a separate VMware advisory,...

CVE-2020-4006

CVE-2020-4006 (VMware) is a remote command-injection flaw in VMware Workspace ONE Access, Access Connector, Identity Manager, and Identity Manager Connector. A attacker with network access to the administrative configurator (port 8443) and valid credentials could execute commands with unrestricte...

CVE-2020-4006

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability...

CVE-2020-4006

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability...

Vmware Workspace One Command Injection Vulnerability

Vmware Vmware Workspace One is a platform for supporting cross-device applications for rapid delivery and management of applications from Vmware, USA. The platform, which includes VMware Horizon and VMware Horizon Cloud, integrates access control, application management, and multi-platform endpoi...

VMware ESXi SLP Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of VMware ESXi. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SLP messages. The issue results from the lack of validating the...

VMware ESXi Elevation of Privilege Vulnerability

VMware ESXi is a virtualization software and the software supports windows platform to run. An elevation of privilege vulnerability exists in VMware ESXi. The vulnerability stems from an issue with how certain system calls are managed. An attacker with privileges only in the VMX process could...

VMware VMWare SD-WAN Orchestrator SQL Injection Vulnerability

VMware VMWare SD-WAN Orchestrator is a software for orchestrating network data flows in a software-defined network architecture. A SQL injection vulnerability exists in VMware VMWare SD-WAN Orchestrator, which can be exploited by a remote attacker to submit a special SQL request to manipulate a...