CVE-2019-5534

VMware vCenter Server 6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j contains an information disclosure vulnerability where Virtual Machines deployed from an OVF could expose login information via the virtual machine's vAppConfig properties. A malicious actor with access to...

Information disclosure

VMware vCenter Server 6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j contains an information disclosure vulnerability where Virtual Machines deployed from an OVF could expose login information via the virtual machine's vAppConfig properties. A malicious actor with access to...

Information disclosure

VMware vCenter Server 6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j contains an information disclosure vulnerability due to the logging of credentials in plain-text for virtual machines deployed through OVF. A malicious user with access to the log files containing vCenter...

CVE-2019-5532

CVE-2019-5532 affects VMware vCenter Server and is an information-disclosure vulnerability caused by plain-text logging of OVF deployment credentials. A malicious user with access to vCenter OVF log files could view credentials (typically root) used to deploy the VM. Affected product lines includ...

CVE-2019-5532

VMware vCenter Server 6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j contains an information disclosure vulnerability due to the logging of credentials in plain-text for virtual machines deployed through OVF. A malicious user with access to the log files containing vCenter...

CVE-2019-5534

VMware vCenter Server 6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j contains an information disclosure vulnerability where Virtual Machines deployed from an OVF could expose login information via the virtual machine's vAppConfig properties. A malicious actor with access to...

CVE-2019-5534

Summary (CVE-2019-5534): VMware vCenter Server and related ESXi/Vsphere components are affected by an information-disclosure issue in OVF deployments, where vAppConfig properties can reveal credentials (typically root) used to deploy the OVF. A malicious actor with access to query these vAppConfi...

VMware Releases Security Updates for Multiple Products

VMware has released security updates to address vulnerabilities in ESXi and vCenter. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review VMware Securi...

VMware ESXi and vCenter Server updates address command injection and information disclosure vulnerabilities. (CVE-2017-16544, CVE-2019-5531, CVE-2019-5532, CVE-2019-5534)

3a. VMware ESXi 'busybox' command injection vulnerability- CVE-2017-16544 ESXi contains a command injection vulnerability due to the use of vulnerable version of busybox that does not sanitize filenames which may result into executing any escape sequence in the shell. VMware has evaluated the...

VMSA-2019-0013:VMware ESXi and vCenter Server updates address command injection and information disclosure vulnerabilities.

VMware Security Advisories Advisory ID| VMSA-2019-0013.1 ---|--- Advisory Severity| Important CVSSv3 Range| 4.2-7.7 Synopsis| VMware ESXi and vCenter Server updates address command injection and information disclosure vulnerabilities. CVE-2017-16544, CVE-2019-5531, CVE-2019-5532, CVE-2019-5534...

CVE-2019-6179

An XML External Entity XXE processing vulnerability was reported in Lenovo XClarity Administrator LXCA prior to version 2.5.0 , Lenovo XClarity Integrator LXCI for Microsoft System Center prior to version 7.7.0, and Lenovo XClarity Integrator LXCI for VMWare vCenter prior to version 6.1.0 that...

Xxe

An XML External Entity XXE processing vulnerability was reported in Lenovo XClarity Administrator LXCA prior to version 2.5.0 , Lenovo XClarity Integrator LXCI for Microsoft System Center prior to version 7.7.0, and Lenovo XClarity Integrator LXCI for VMWare vCenter prior to version 6.1.0 that...

CVE-2019-6179

CVE-2019-6179 is an XML External Entity (XXE) processing vulnerability found in Lenovo XClarity Administrator (LXCA) before 2.5.0, Lenovo XClarity Integrator (LXCI) for Microsoft System Center before 7.7.0, and LXCI for VMware vCenter before 6.1.0. The issue, as described in Lenovo’s advisory, co...

CVE-2019-6179

An XML External Entity XXE processing vulnerability was reported in Lenovo XClarity Administrator LXCA prior to version 2.5.0 , Lenovo XClarity Integrator LXCI for Microsoft System Center prior to version 7.7.0, and Lenovo XClarity Integrator LXCI for VMWare vCenter prior to version 6.1.0 that...

LXCA and LXCI Insufficient Input Validation - US

Lenovo Security Advisory: LEN-27805 Potential Impact: Information disclosure, code execution Severity: Medium Scope of Impact: Lenovo-specific CVE Identifier: CVE-2019-6179, CVE-2019-6180, CVE-2019-6181, CVE-2019-6182 Summary Description: Vulnerabilities reported in Lenovo XClarity Administrator...

Qualys Cloud Platform (VM, PC) 8.21 New Features

This new release of the Qualys Cloud Platform VM, PC, version 8.21, adds new technologies and platforms, and support for scanning ESXi hosts on vCenter for vulnerabilities. Feature Highlights Qualys Vulnerability Management VM Support for Scanning ESXi Hosts on vCenter for Vulnerabilities – Qualy...

The vulnerability of the vGate virtualization platform’s security tool, which allows a intruder to disclose protected information

The vulnerability of the vGate virtualization platform’s security mechanism is related to insufficient control over operations within the vSphere environment. This allows clones of machines to be created on another vCenter without checking the permission rules for access restrictions set by vGate...

Cohesity DataPlatform Man-in-the-Middle Vulnerability

Cohesity DataPlatform is a suite of platforms from Cohesity for managing ancillary data and applications. The platform is primarily used for data backup, instant recovery, etc. A security vulnerability exists in Cohesity DataPlatform version 5.x and version 6.x prior to 6.1.1c, which stems from t...

CVE-2019-11242

A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not verify TLS certificates presented by vCenter. This vulnerability could expose Cohesity user credentials configured to access vCenter...

CVE-2019-11242

A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not verify TLS certificates presented by vCenter. This vulnerability could expose Cohesity user credentials configured to access vCenter...