VMware Releases Security Updates for VMware vRealize Log Insight

VMware released security updates to address multiple vulnerabilities in VMware vRealize Log Insight. A remote attacker could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review VMware Security Advisory VMSA-2023-0001 and apply th...

Vulnerabilities fixed in VMWare vRealize Log Insight

VMWare has fixed vulnerabilities in vRealize Log Insight. A unauthenticated malicious person could exploit the vulnerabilities to cause a denial-of-service, to access gain access to system data, or to potentially execute arbitrary code execute system privileges via injecting files at the operatin...

CVE-2022-31710

vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization of untrusted data which could result in a denial of service...

CVE-2022-31704

The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution...

CVE-2022-31710

vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization of untrusted data which could result in a denial of service...

CVE-2022-31711

VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and application information without authentication...

CVE-2022-31711

VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and application information without authentication...

CVE-2022-31710

CVE-2022-31710 affects VMware vRealize Log Insight and is caused by a deserialization vulnerability that an unauthenticated attacker can trigger remotely to cause a DoS. The vulnerability is part of a set of flaws in vRealize Log Insight (8.x) that VMware addressed in version 8.10.2 under VMSA-20...

CVE-2022-31706

VMware vRealize Log Insight (now VMware Aria Operations for Logs) contains CVE-2022-31706: a directory traversal flaw that allows an unauthenticated attacker to inject files into the appliance OS, leading to remote code execution. Affected release series are 8.x prior to 8.10.2, with the vendor a...

CVE-2022-31706

The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution...

CVE-2022-31711

CVE-2022-31711 affects VMware vRealize Log Insight. The provided sources consistently describe an Information Disclosure vulnerability that allows an unauthenticated, remote actor to collect sensitive session and application information. The issue is categorized with CVSS v3.1 metrics (AV:N/AC:L/...

CVE-2022-31704

CVE-2022-31704 affects VMware vRealize Log Insight. A broken access control vulnerability allows an unauthenticated attacker to remotely inject code into sensitive files on the impacted appliance, enabling remote code execution. Affected product: VMware vRealize Log Insight (now part of VMware Ar...

CVE-2022-31706

The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution...

VMware vRealize Operations 8.x < 8.10 Arbitrary File Read (VMSA-2022-0026)

The version of VMware vRealize Operations vROps running on the remote host is 8.x prior to 8.10. It is, therefore, affected by a vulnerability: - VMware Aria Operations contains an arbitrary file read vulnerability. A malicious actor with administrative privileges may be able to read arbitrary...

PT-2023-1176 · Vmware · Vrealize Log Insight

Name of the Vulnerable Software and Affected Versions: vRealize Log Insight affected versions not specified Description: The vRealize Log Insight contains a Directory Traversal Vulnerability, allowing an unauthenticated, malicious actor to inject files into the operating system of an impacted...

PT-2023-1356 · Vmware · Vrealize Log Insight

Name of the Vulnerable Software and Affected Versions: vRealize Log Insight affected versions not specified Description: The issue is related to a deserialization vulnerability in vRealize Log Insight, which can be exploited by an unauthenticated malicious actor to trigger the deserialization of...

PT-2023-1178 · Vmware · Vrealize Log Insight

Name of the Vulnerable Software and Affected Versions: vRealize Log Insight affected versions not specified Description: The issue is related to a broken access control vulnerability in vRealize Log Insight. This vulnerability allows an unauthenticated malicious actor to remotely inject code into...

VMSA-2023-0001:VMware vRealize Log Insight latest updates address multiple security vulnerabilities

Advisory ID: VMSA-2023-0001.1 CVSSv3 Range: 5.3-9.8 Issue Date:2023-01-24 Updated On: 2023-01-31 CVEs: CVE-2022-31706, CVE-2022-31704, CVE-2022-31710, CVE-2022-31711 Synopsis: VMware vRealize Log Insight latest updates address multiple security vulnerabilities CVE-2022-31706, CVE-2022-31704,...

VMware vRealize Network Insight createSupportBundle Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VMware vRealize Network Insight. Authentication is not required to exploit this vulnerability. The specific flaw exists within the createSupportBundle function. The issue results from the lack of...

VMware vRealize Network Insight downloadFile Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of VMware vRealize Network Insight. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloadFile function. The issue results from the lack of...