786 matches found
VMware vRealize Operations updates address Server Side Request Forgery and Arbitrary File Write vulnerabilities (CVE-2021-21975, CVE-2021-21983)
3a. Server Side Request Forgery in vRealize Operations Manager API CVE-2021-21975 The vRealize Operations Manager API contains a Server Side Request Forgery. VMware has evaluated this issue to be of 'Important' severity with a maximum CVSSv3 base score of 8.6. 3b. Arbitrary file write vulnerabili...
VMSA-2021-0004:VMware vRealize Operations updates address Server Side Request Forgery and Arbitrary File Write vulnerabilities
Advisory ID: VMSA-2021-0004.2 CVSSv3 Range: 7.2 - 8.6 Issue Date:2021-03-30 Updated On: 2021-08-24 CVEs: CVE-2021-21975, CVE-2021-21983 Synopsis: VMware vRealize Operations updates address Server Side Request Forgery and Arbitrary File Write vulnerabilities CVE-2021-21975, CVE-2021-21983 RSS Feed...
Vulnerabilities fixed in Salt
Vulnerabilities have been fixed in Salt. Salt is used used in VMware vRealize Operations Manager and RSA NetWitness. The vulnerabilities allow a malicious party to carry out attacks execute attacks that lead to the following categories of damage: Bypassing authentication Bypassing security measur...
Critical Unpatched VMware Flaw Affects Multiple Corporates Products
VMware has released temporary workarounds to address a critical vulnerability in its products that could be exploited by an attacker to take control of an affected system. "A malicious actor with network access to the administrative configurator on port 8443 and a valid password for the...
The vulnerability of the monitoring tool for the virtual infrastructure vRealize Operations lies in insufficient validation of input data, allowing a perpetrator to execute arbitrary code.
The vulnerability of the monitoring tool for the virtual infrastructure vRealize Operations is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...
The vulnerability of the monitoring tool for the virtual infrastructure vRealize Operations, related to writing beyond the buffer boundaries, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the monitoring tool for the vRealize Operations virtual infrastructure is related to writing beyond the buffer boundaries. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the monitoring tool for the virtual infrastructure vRealize Operations, related to authentication errors, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the monitoring tool for the vRealize Operations virtual infrastructure is related to authentication errors. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
SaltStack Salt Master/Minion Unauthenticated Remote Code Execution Exploit
This Metasploit module exploits unauthenticated access to the runner and sendpub methods in the SaltStack Salt master's ZeroMQ request server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to execute code as root on either the master or on select minions. VMware vRealize Operations...
SaltStack Salt Master/Minion Unauthenticated Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SaltStack Salt Master/Minion Unauthenticated RCE', 'Description' = %q This module exploits unauthenticated access to the runner and sendpub metho...
SaltStack Salt Master Server Root Key Disclosure
This module exploits unauthenticated access to the prepauthinfo method in the SaltStack Salt master's ZeroMQ request server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to disclose the root key used to authenticate administrative commands to the master. VMware vRealize Operations...
SaltStack Salt Master/Minion Unauthenticated RCE
This module exploits unauthenticated access to the runner and sendpub methods in the SaltStack Salt master's ZeroMQ request server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to execute code as root on either the master or on select minions. VMware vRealize Operations Manager...
VMware Publishes Workarounds for Vulnerabilities in vRealize Operations Manager
VMware has published workarounds to address unpatched vulnerabilities in vRealize Operations Manager vROps. A remote attacker could exploit these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to...
vRealize Operations Application Remote Collector (ARC) addresses Authentication Bypass and Directory Traversal vulnerabilities (CVE-2020-11651, CVE-2020-11652)
3. vRealize Operations Application Remote Collector ARC addresses Authentication Bypass CVE-2020-11651 and Directory Traversal CVE-2020-11652 vulnerabilities. The Application Remote Collector ARC introduced with vRealize Operations 7.5 utilizes Salt which is affected by CVE-2020-11651 and...
VMSA-2020-0009:vRealize Operations Application Remote Collector (ARC) addresses Authentication Bypass and Directory Traversal vulnerabilities
Advisory ID: VMSA-2020-0009.1 CVSSv3 Range: 7.5-10.0 Issue Date:2020-05-08 Updated On: 2020-05-15 Initial Advisory CVEs: CVE-2020-11651, CVE-2020-11652 Synopsis: vRealize Operations Application Remote Collector ARC addresses Authentication Bypass and Directory Traversal vulnerabilities...
The vulnerability of the vRealize Log Insight log management tool lies in the lack of security measures for the website structure, allowing attackers to perform cross-site scripting attacks.
The vulnerability of the log management tool vRealize Log Insight is related to the lack of security measures for the website structure. Exploiting this vulnerability could allow a malicious actor to perform a cross-site scripting attack remotely...
The vulnerability of the vRealize Log Insight log management tool lies in insufficient validation of input data, allowing a hacker to redirect users to a malicious website.
The vulnerability of the vRealize Log Insight log management tool is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to redirect users to a malicious website...
VMware vRealize Log Insight 4.x < 8.1.0 XSS Vulnerability (VMSA-2020-0007)
The VMware vRealize Log Insight application running on the remote host is 4.0.0 or later but prior to 8.1.0. It is, therefore, affected by a XSS vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid135923; scriptversion"1.3";...
VMware vRealize Log Insight Input Validation Error Vulnerability
VMware vRealize Log Insight provides real-time log management capabilities for VMware environments. An input validation error vulnerability exists in VMware vRealize Log Insight, which stems from the program's inability to properly validate user input. An attacker could exploit the vulnerability...
VMware vRealize Log Insight Cross-Site Scripting Vulnerability (CNVD-2020-27463)
VMware vRealize Log Insight provides real-time log management capabilities for VMware environments. A cross-site scripting vulnerability exists in VMware vRealize Log Insight that originates from the program's inability to properly validate user input. An attacker could exploit the vulnerability ...
