CVE-2021-21985

The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...

Remote code execution

The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...

CVE-2021-21985

CVE-2021-21985 affects VMware vCenter Server via the vSphere Client (HTML5) and the default-enabled Virtual SAN Health Check plug‑in. Root cause: improper input validation leads to remote code execution when an attacker with network access to port 443 sends crafted input, enabling commands with u...

CVE-2021-21985

The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...

CVE-2021-21985

The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...

CVE-2021-21985

The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...

VMware vCenter Server远程代码执行漏洞（CVE-2021-21985）

Rapid7 May 26, 2021 5:34pm UTC 1 day ago• Last updated May 27, 2021 6:39pm UTC 7 hours ago Technical Analysis Threat status: Impending threat Attacker utility: Network infrastructure compromise Description On Tuesday, May 25, 2021, VMware published security advisory VMSA-2021-0010, which includes...

PT-2021-3176

Name of the Vulnerable Software and Affected Versions vSphere Client HTML5 affected versions not specified VMware vCenter Server affected versions not specified Description The issue exists due to insufficient input validation in the Virtual SAN Health Check plug-in, which is enabled by default i...

VMware vCenter Server Virtual SAN Health Check Plugin RCE

This module exploits Java unsafe reflection and SSRF in the VMware vCenter Server Virtual SAN Health Check plugin's ProxygenController class to execute code as the vsphere-ui user. See the vendor advisory for affected and patched versions. Tested against VMware vCenter Server 6.7 Update 3m Linux...

VMSA-2021-0010:VMware vCenter Server updates address remote code execution and authentication vulnerabilities

Advisory ID: VMSA-2021-0010 CVSSv3 Range: 6.5-9.8 Issue Date:2021-05-25 Updated On: 2021-05-25 Initial Advisory CVEs: CVE-2021-21985, CVE-2021-21986 Synopsis: VMware vCenter Server updates address remote code execution and authentication vulnerabilities CVE-2021-21985, CVE-2021-21986 RSS Feed...

Unauthorized Access Vulnerability in H3C SecPath Operations Audit System

Xinhua San Technology Co., Ltd. is a new IT solution provider, committed to become the most trusted partner for customers' business innovation and digital transformation. The main products are routers, big data, switches, IoT, cloud computing, servers and so on. An unauthorized access vulnerabili...

Weak Password Vulnerability in F100 Series of Xinhua San Technologies Co.

The F100 series is a firewall from Xinhua San Technologies Co. A weak password vulnerability exists in the F100 series of Xinhua San Technologies Limited, which can be exploited by attackers to obtain sensitive information...

HPESBST04137 rev.1 - HPE Fibre Channel and SAN Switches with Brocade Fabric OS (FOS) Prior to v8.2.3, Multiple Remote and Local Vulnerabilities

Potential Security Impact: Local: Arbitrary Code Execution, Unauthorized Write Access to the File System; Remote: Denial of Service DoS, Unauthorized Data Injection SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Brocade 16Gb Fibre Channel SAN Switch for HPE Synergy - Prior to 8.2...

HPESBST04139 rev.1 - HPE Fibre Channel and SAN Switches with Brocade Fabric OS (FOS) Prior to v9.0.1a, Multiple Remote and Local Vulnerabilities

Potential Security Impact: Local: Arbitrary Code Execution, Unauthorized Write Access to the File System; Remote: Authentication Bypass, Denial of Service DoS, Disclosure of Sensitive Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Brocade 32Gb Fibre Channel SAN Switch...

Unauthorized Access Vulnerability in the Operations and Maintenance Audit System of Xinhua San Technologies Co.

Xinhua San Technology Co., Ltd. is committed to becoming the most reliable partner for customers' business innovation and digital transformation. The main products are routers, big data, switches, IoT, cloud computing, servers and so on. An unauthorized access vulnerability exists in the Operatio...

Command Execution Vulnerability in User Self-Service Platform of Xinhua San Technologies Co.

Xinhua San Technology Co., Ltd. is committed to becoming a trusted partner for customers' business innovation and digital transformation. A command execution vulnerability exists in the user self-service platform of Xinhua San Technologies Co. An attacker can exploit this vulnerability to gain...

Security Bulletin: Vulnerability in Fabric OS used by IBM b-type SAN directors and switches.

Summary Public disclosed vulnerability from OpenSSL in the Fabric OS used by IBM b-type SAN directors and switches. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an...

Weak Password Vulnerability in Multiple Systems of Xinhua San

ER3100, ER5200G2, ER3260G2, ER3200G2, ER8300G2 are router products of Xinhua San Technologies Co. A weak password vulnerability exists in multiple systems of Xinhua San, which can be exploited by attackers to obtain sensitive information...

Unauthorized Access Vulnerability in H3C Smart O&M Platforms

Xinhua San Technology Co., Ltd. is committed to becoming a trusted partner for customers' business innovation and digital transformation. An unauthorized access vulnerability exists in H3C Smart Operation and Maintenance Platform, which can be exploited by attackers to obtain sensitive informatio...

Details on the Unlocking of the San Bernardino Terrorist’s iPhone

The Washington Post has published a long story on the unlocking of the San Bernardino Terrorists iPhone 5C in 2016. We all thought it was an Israeli company called Cellebrite. It was actually an Australian company called Azimuth Security. Azimuth specialized in finding significant vulnerabilities...