Announcing Metasploit 6.2

Metasploit 6.2.0 has been released, marking another milestone that includes new modules, features, improvements, and bug fixes. Since Metasploit 6.1.0 August 2021 until the latest Metasploit 6.2.0 release we’ve added: 138 new modules 148 enhancements and features 156 bug fixes Top modules Each...

VMware vCenter Server 6.5 < 6.5 U3n / 6.7 < 6.7 U3l / 7.0 < 7.0 U1c Remote Code Execution

The vSphere Client HTML5 contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects...

VMWare vCenter Server 7.0 < 7.0 U1c / 6.7 < 6.7 U3l / 6.5 < 6.5 U3n Server Side Request Forgery

The vSphere Client HTML5 contains an SSRF Server Side Request Forgery vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information...

VMWare vCenter Server 6.5 < 6.5 U3p / 6.7 < 6.7 U3n / 7.0 < 7.0 U2b Remote Code Execution

The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...

VulnCheck KEV: CVE-2021-21980

The vSphere Web Client FLEX/Flash contains an unauthorized arbitrary file read vulnerability. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information...

GHSA-W589-R335-4F55 SaltStack Salt Improper Certificate Validation

In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers in the vmware.py files does not always validate the SSL/TLS certificate...

Metasploit Weekly Wrap-Up

Zyxel firewall unauthenticated command injection This week, our very own Jake Baines added an exploit module that leverages CVE-2022-30525, an unauthenticated remote command injection vulnerability in Zyxel firewalls with zero touch provisioning ZTP support. Jake is also the author of the origina...

Exploit for Path Traversal in Vmware Cloud_Foundation

CVE-2021-21972 VMware vCenter Server Remote Code Execution Vul...

VMware vCenter Forge SAML Authentication Credentials

This module forges valid SAML credentials for vCenter server using the vCenter SSO IdP certificate, IdP private key, and VMCA certificates as input objects; you must also provide the vCenter SSO domain name and vCenter FQDN. The module will return a session cookie for the /ui path that grants...

Security Bulletin: Multiple Vulnerabilities in VMware vCenter affect IBM Cloud Pak System

Summary Multiple vulnerabilities in VMware vCenter plugins affect IBM Cloud Pak System. IBM Cloud Pak System in response to the vulnerabilities in VMware vCenter, provides the new release of IBM Cloud Pak System V2.3.3.4, with a new vCenter Image. Vulnerability Details CVEID:CVE-2021-21985...

VMware vCenter Server Information Disclosure Vulnerability (CNVD-2022-55066)

VMware vCenter Server is a suite of server and virtualization management software from Vmware, Inc. VMware vCenter Server is vulnerable to an information disclosure vulnerability that could be exploited by an attacker with unmanaged access to gain access to sensitive information...

CVE-2022-22948

The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information...

CVE-2022-22948

The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information...

Information disclosure

The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information...

CVE-2022-22948

The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information...

CVE-2022-22948

The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information...

CVE-2022-22948

CVE-2022-22948 affects VMware vCenter Server and is caused by improper default/file permissions that allow non-administrative access to disclose sensitive information. Public sources document VMSA-2022-0009, listing affected versions: vCenter 6.5 up to 6.5U3r, 6.7 up to 6.7U3p, and 7.0 up to 7.0U...

VMware vCenter Server updates address an information disclosure vulnerability (CVE-2022-22948)

3. vCenter Server information disclosure vulnerability CVE-2022-22948 The vCenter Server contains an information disclosure vulnerability due to improper permission of files. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of...

VMware vCenter Server 安全漏洞

VMware vCenter Server is a suite of server and virtualization management software from Vmware, Inc. VMware vCenter Server is vulnerable to an information disclosure vulnerability that could be exploited by an attacker with unmanaged access to gain access to sensitive information...

CVE-2022-22948

The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information. Recent assessments: Assessed Attacker Value: 0 Assessed...