CVE-2020-5414

VMware Tanzu Application Service for VMs 2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7 contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are...

CVE-2019-11286

VMware GemFire versions prior to 9.10.0, 9.9.1, 9.8.5, and 9.7.5, and VMware Tanzu GemFire for VMs versions prior to 1.11.0, 1.10.1, 1.9.2, and 1.8.2, contain a JMX service available to the network which does not properly restrict input. A remote authenticated malicious user may request against t...

CVE-2020-5396

VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a SecurityManager, contain a JMX service available which contains an insecure default configuration. This allows a malicious user to create...

CVE-2019-11286

VMware GemFire versions prior to 9.10.0, 9.9.1, 9.8.5, and 9.7.5, and VMware Tanzu GemFire for VMs versions prior to 1.11.0, 1.10.1, 1.9.2, and 1.8.2, contain a JMX service available to the network which does not properly restrict input. A remote authenticated malicious user may request against t...

Remote code execution

VMware GemFire versions prior to 9.10.0, 9.9.1, 9.8.5, and 9.7.5, and VMware Tanzu GemFire for VMs versions prior to 1.11.0, 1.10.1, 1.9.2, and 1.8.2, contain a JMX service available to the network which does not properly restrict input. A remote authenticated malicious user may request against t...

Design/Logic Flaw

VMware Tanzu Application Service for VMs 2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7 contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are...

Default configuration

VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a SecurityManager, contain a JMX service available which contains an insecure default configuration. This allows a malicious user to create...

CVE-2020-5414 App Autoscaler logs credentials

VMware Tanzu Application Service for VMs 2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7 contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are...

CVE-2020-5414

The CVE-2020-5414 entry concerns VMware Tanzu Application Service for VMs (2.7.x prior to 2.7.19, 2.8.x prior to 2.8.13, 2.9.x prior to 2.9.7) where the App Autoscaler logs UAA admin and App Autoscaler Broker passwords. Logs are redacted in VMware Tanzu Operations Manager, but unredacted logs wer...

CVE-2019-11286

The CVE-2019-11286 issue affects VMware GemFire products with a JMX service exposed to the network that does not properly restrict input. A remote authenticated attacker could exploit this via a crafted set of credentials, leading to remote code execution. Affected versions include GemFire prior ...

CVE-2020-5396

The CVE affects VMware GemFire up to versions 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs up to 1.11.1 and 1.10.2. When deployed without a SecurityManager, a JMX service is exposed with an insecure default configuration. This enables a malicious user to create an MLet MBean,...

CVE-2019-11286 JMX Credential Deserialization in GemFire

VMware GemFire versions prior to 9.10.0, 9.9.1, 9.8.5, and 9.7.5, and VMware Tanzu GemFire for VMs versions prior to 1.11.0, 1.10.1, 1.9.2, and 1.8.2, contain a JMX service available to the network which does not properly restrict input. A remote authenticated malicious user may request against t...

CVE-2020-5396 JMX Insecure Default Configuration in GemFire

VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a SecurityManager, contain a JMX service available which contains an insecure default configuration. This allows a malicious user to create...

VMware Fusion 11.x < 11.5.5 Privilege Escalation (VMSA-2020-0017)

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 11.x prior to 11.5.5. It is, therefore, affected by a privilege escalation vulnerability due to Improper XPC Client validation. An authenticated, local attacker can exploit this to escalate their normal user privileges...

VMware Horizon View Client 5.x < 5.4.3 Privilege Escalation (VMSA-2020-0017) (macOS)

The version of VMware Horizon View Client installed on the remote macOS or Mac OS X host is 5.x prior to 5.4.3. It is, therefore, affected by a privilege escalation vulnerability in the service startup script due to improper XPC Client validation. A local attacker with normal user privileges can...

CVE-2020-5414

VMware Tanzu Application Service for VMs 2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7 contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are...

CVE-2020-5396

VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a SecurityManager, contain a JMX service available which contains an insecure default configuration. This allows a malicious user to create...

Photon OS 1.0: Linux PHSA-2020-1.0-0310

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0310. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid139079...

Photon OS 1.0: Bindutils PHSA-2020-1.0-0309

An update of the bindutils package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0309. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 3.0: Linux PHSA-2020-3.0-0119

An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0119. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid139076;...