VMware ESX / ESXi Remotely Accessible Method Object Browser API

The remote VMware ESX / ESXi host has a Method Object Browser API accessible in the /mob directory on the web interfaces. This is disabled by default. If enabled, the MOB allows remote attackers to invoke methods on VMware ESX / ESXi objects, including create and destroy. This can allow a remote...