CVE-2021-21972

CVE-2021-21972 CVE-2021-21972 Works On VMware-VCSA-all-6.7.0-8217866, VMware-VIM-all-6.7.0-8217866 ✔ VMware-VCSA-all-6.5.0-16613358 ✔ For vCenter6.7 U2+ vCenter 6.7U2+ runs the website in memory, so this exploit cannot work for 6.7 u2+. Needs Testing vCenter 6.5 Linux VCSA/WindowsAwaiting Testing...

vcsa-hardening-tool

VCSA Hardening & Logging Tool An automated hardening script for the VMware vCenter Server Appliance VCSA designed to enforce Zero Trust network segmentation and deep forensic auditing. This tool is engineered to mitigate critical risks associated with advanced persistent threats APTs and...

CVE-2021-21972

CVE-2021-21972 CVE-2021-21972 Tested against VMware VCSA 6.7 create ssh keypair ssh-keygen -t rsa -f vcsa.key -N '' create tarbal with ../../../../../home/vsphere-ui/.ssh/authorizedkeys python2 evilarc.py -d 5 -p 'home/vsphere-ui/.ssh' -o unix -f evil.tar authorizedkeys mv evil.tar evil.ova uploa...

PT-2026-79640

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read issue exists in the Linux kernel's fbdev component. The bit cursor function fetches a glyph under the cursor using a value obtained from scr readw, which may exceed...

Security Bulletin: Vulnerabilities in VMware vCenter affect Cloud Pak System [CVE-2024-38812, CVE-2024-38813]

Summary Vulnerabilities in VMware vCenter affect Cloud Pak System. Vulnerability Details CVEID:CVE-2024-38812 DESCRIPTION: Broadcom VMware vCenter Server is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the implementation of the DCERPC protocol. By sending a...

Restore a deleted vCenter Server Appliance (VCSA) with High Availability (HA) enabled

Challenge You need to restore a vCenter Server Appliance VCSA with the original name and to the original location. Before the VCSA got corrupted or was deleted, High Availability HA was enabled in the VMware cluster. If HA remains active at the ESXi host level during the restore process, HA can...

Privilege escalation

VMware vCenter Server Appliance vCSA 6.5 before 6.5 U1d contains a local privilege escalation vulnerability via the 'showlog' plugin. Successful exploitation of this issue could result in a low privileged user gaining root level privileges over the appliance base OS...

CVE-2017-4943

CVE-2017-4943 affects VMware vCenter Server Appliance (vCSA) 6.5 prior to 6.5 Update 1d (U1d). A local privilege-escalation via the 'showlog' plugin could allow a low-privileged user to gain root privileges on the appliance base OS. Public details in VMware’s VMSA-2017-0021 describe this issue an...

PT-2017-16225

Name of the Vulnerable Software and Affected Versions VMware vCenter Server Appliance vCSA versions 6.5 before 6.5 U1d Description The issue is a local privilege escalation vulnerability via the showlog plugin. Successful exploitation could result in a low-privileged user gaining root-level...

CVE-2017-4943: Out-of-bounds Write

VMware vCenter Server Appliance vCSA 6.5 before 6.5 U1d contains a local privilege escalation vulnerability via the 'showlog' plugin. Successful exploitation of this issue could result in a low privileged user gaining root level privileges over the appliance base OS...

Cross site scripting

Cross-site scripting XSS vulnerability in VMware vCenter Server Appliance vCSA 5.1 before Update 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8371

CVE-2014-8371 affects VMware vCenter Server and vCSA when connecting to an ESXi CIM server; root cause is improper certificate validation that enables MITM spoofing of CIM services. Affected versions: vCSA 5.5 before Update 2, vCenter Server 5.1 before Update 3, and 5.0 before Update 3c. Remediat...

CVE-2014-3797: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in VMware vCenter Server Appliance vCSA 5.1 before Update 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8371: Undefined Security Weakness

VMware vCenter Server Appliance vCSA 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate...

VMSA-2014-0012 : VMware vSphere product updates address security vulnerabilities

a. VMware vCSA cross-site scripting vulnerability VMware vCenter Server Appliance vCSA contains a vulnerability that may allow for Cross Site Scripting. Exploitation of this vulnerability in vCenter Server requires tricking a user to click on a malicious link or to open a malicious web page. VMwa...

VMware Security Updates for vCenter Server (VMSA-2014-0012)

VMware vCenter product updates address a Cross Site Scripting issue, a certificate validation issue and security vulnerabilities in third-party libraries. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

PT-2014-5506

Name of the Vulnerable Software and Affected Versions VMware vCenter Server Appliance vCSA versions 5.1 before Update 3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For versions 5.1 before Upda...

PT-2014-8495

Name of the Vulnerable Software and Affected Versions VMware vCenter Server Appliance vCSA versions 5.0 through 5.0 before Update 3c VMware vCenter Server Appliance vCSA versions 5.1 through 5.1 before Update 3 VMware vCenter Server Appliance vCSA versions 5.5 through 5.5 before Update 2...

VMware vSphere product updates address security vulnerabilities

a. VMware vCSA cross-site scripting vulnerabilityVMware vCenter Server Appliance vCSA contains a vulnerability that may allow for Cross Site Scripting. Exploitation of this vulnerability in vCenter Server requires tricking a user to click on a malicious link or to open a malicious web page. VMwar...

VMSA-2014-0012:VMware vSphere product updates address security vulnerabilities

VMSA-2014-0012.1 VMware vSphere product updates address security vulnerabilities VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2014-0012.1 VMware Security Advisory Synopsis: VMware vSphere product updates address security vulnerabilities VMware Security Advisory Issue date:...