CVE-2011-1788

CVE-2011-1788 is discussed in VMware advisory VMSA-2011-0008 and related Nessus plugin; it covers SOAP session ID disclosure in vCenter Server as part of multiple VMware vulnerabilities. Connected documents also describe: (1) CVE-2011-0426 (directory traversal) affecting vCenter Server, VirtualCe...

CVE-2011-0426

Directory traversal vulnerability in vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, and VMware VirtualCenter 2.5 before Update 6a, allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2011-0426

CVE-2011-0426 corresponds to VMware vCenter Server and VirtualCenter directory traversal vulnerability that allows remote read of arbitrary files via unspecified vectors. Affected products/versions per advisories: vCenter Server 4.0 before Update 3, vCenter Server 4.1 before Update 1, and Virtual...

CVE-2011-1788

vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1 allows local users to discover the SOAP session ID via unspecified vectors...

CVE-2011-1789

The self-extracting installer in the vSphere Client Installer package in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, VMware ESXi 4.x before 4.1 Update 1, and VMware ESX 4.x before 4.1 Update 1 does not have a digital signature, which might make it easier for remote attackers to...

CVE-2011-0426: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, and VMware VirtualCenter 2.5 before Update 6a, allows remote attackers to read arbitrary files via unspecified vectors...

PT-2011-2339

Name of the Vulnerable Software and Affected Versions VMware vCenter versions 4.0 through 4.0 Update 2 VMware vCenter version 4.1 VMware VirtualCenter versions 2.5 through 2.5 Update 5 Description A directory traversal issue allows remote attackers to read arbitrary files via unspecified vectors...

PT-2011-3370

Name of the Vulnerable Software and Affected Versions VMware vCenter versions 4.0 through 4.0 Update 2 VMware vCenter versions 4.1 through 4.1 Update 0 VMware ESXi versions 4.x through 4.1 Update 0 VMware ESX versions 4.x through 4.1 Update 0 Description The issue is related to the self-extractin...

CVE-2011-1788: Exposure of Sensitive Information to an Unauthorized Actor

vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1 allows local users to discover the SOAP session ID via unspecified vectors...

PT-2011-3369

Name of the Vulnerable Software and Affected Versions vCenter Server versions 4.0 before Update 3 vCenter Server versions 4.1 before Update 1 Description The issue allows local users to discover the SOAP session ID via unspecified vectors. Recommendations For vCenter Server versions 4.0 before...

VMSA-2011-0008 : VMware vCenter Server and vSphere Client security vulnerabilities

a. vCenter Server Directory Traversal vulnerability A directory traversal vulnerability allows an attacker to remotely retrieve files from vCenter Server without authentication. In order to exploit this vulnerability, the attacker will need to have access to the network on which the vCenter Serve...

CVE-2011-1789: Undefined Security Weakness

The self-extracting installer in the vSphere Client Installer package in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, VMware ESXi 4.x before 4.1 Update 1, and VMware ESX 4.x before 4.1 Update 1 does not have a digital signature, which might make it easier for remote attackers to...

VMWare vCenter Server / vSphere Client security vulnerabilities

Directory traversal, information leakage...

VMSA-2011-0008 VMware vCenter Server and vSphere Client security vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ VMware Security Advisory Advisory ID: VMSA-2011-0008 Synopsis: VMware vCenter Server and vSphere Client security vulnerabilities Issue date: 2011-05-05 Updated on: 2011-05-05...

VMSA-2011-0008:VMware vCenter Server and vSphere Client security vulnerabilities

VMSA-2011-0008 VMware vCenter Server and vSphere Client security vulnerabilities VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2011-0008 VMware Security Advisory Synopsis: VMware vCenter Server and vSphere Client security vulnerabilities VMware Security Advisory Issue date:...

VMware vCenter Orchestrator and Alive Enterprise remote code execution vulnerability

a. Vulnerability in third party Apache Struts componentVMware vCenter Orchestrator is an application to automate management tasks. Alive Enterprise is an application to monitor processes. Both products embed Apache Struts which is a third party component.The following vulnerability has been...

VMSA-2011-0005:VMware vCenter Orchestrator and Alive Enterprise remote code execution vulnerability

VMSA-2011-0005.3 VMware vCenter Orchestrator and Alive Enterprise remote code execution vulnerability VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2011-0005.3 VMware Security Advisory Synopsis: VMware vCenter Orchestrator and Alive Enterprise remote code execution...

VMSA-2010-0012 : VMware vCenter Update Manager Fix for Jetty Web Server

The version of VMware vCenter Update Manager installed on the remote Windows host is 4.0 earlier than Update 3 or 4.1 earlier than Update 1. The installed version is, therefore, potentially affected by multiple vulnerabilities in the embedded Jetty Web server : - A directory traversal vulnerabili...

VMSA-2009-0017 : VMware vCenter, ESX patch and vCenter Lab Manager releases address XSS issues

a. WebWorks Help - Cross-site scripting vulnerability WebWorks Help is an output format that allows online Help to be delivered on multiple platforms and browsers, which makes it easy to publish information on the Web or on an enterprise intranet. WebWorks Help is used for creating the online hel...

CVE-2010-2928

The vCenter Tomcat Management Application in VMware vCenter Server 4.1 before Update 1 stores log-on credentials in a configuration file, which allows local users to gain privileges by reading this file...