VMware Patches Critical Session Handling Vulnerability

VMware fixed a critical vulnerability in one of its products this week that if exploited by an attacker, could’ve led to a man-in-the-middle attack. According to an advisory, the problem existed in VMware’s Client Integration plugin, a collection of tools present in a handful of other products th...

PT-2016-5003

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 5.5 U3a through 5.5 U3c and 6.0 before U2 vCloud Director version 5.5.5 vRealize Automation Identity Appliance version 6.2.4 Description The issue is related to the mishandling of session content by the Client...

CVE-2016-2076: Improper Authentication

Client Integration Plugin CIP in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, which allows remote attackers to hijack sessions via a crafted web site...

VMWare Releases Security Updates

VMware has released security updates to address a vulnerability in vCenter Server, vCloud Director, vRealize Automation Identity Appliance, and the Client Integration Plugin. Exploitation of this vulnerability may allow a remote attacker to obtain sensitive information. Users and administrators a...

VMware vRealize Business Web UI Detection

Binary data vmwarevrealizebusinesswebuidetect.nbin...

VMware vRealize Business Unspecified Stored XSS (VMSA-2016-0003)

The version of VMware vRealize Business running on the remote host is 8.x prior to 8.2.5. It is, therefore, affected by a stored cross-site scripting vulnerability due to improper validation of user-supplied input. An authenticated, remote attacker can exploit this issue, via a specially crafted...

VMware Patches XSS Vulnerabilities in vRealize Products

VMware patched two cross-site scripting vulnerabilities in its products this week that if exploited, could lead to the compromise of a user’s client workstation. The bugs, stored XSS vulnerabilities and rated important, exist in the company’s vRealize Automation and vRealize Business Advanced and...

CVE-2016-2075

Cross-site scripting XSS vulnerability in VMware vRealize Business Advanced and Enterprise 8.x before 8.2.5 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-2075

Cross-site scripting XSS vulnerability in VMware vRealize Business Advanced and Enterprise 8.x before 8.2.5 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in VMware vRealize Business Advanced and Enterprise 8.x before 8.2.5 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-2344

Cross-site scripting XSS vulnerability in VMware vRealize Automation 6.x before 6.2.4 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in VMware vRealize Automation 6.x before 6.2.4 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-2344

Cross-site scripting XSS vulnerability in VMware vRealize Automation 6.x before 6.2.4 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-2075

Summary (MODE C): CVE-2016-2075 relates to a stored XSS vulnerability in VMware vRealize Business Advanced and Enterprise 8.x prior to 8.2.5 on Linux. The issue arises from improper validation of user-supplied input, allowing an authenticated, remote attacker to inject arbitrary script/HTML via u...

CVE-2015-2344

VMware vRealize Automation 6.x is affected by a stored XSS vulnerability (CVE-2015-2344) in which improper input validation allows injected scripts via unspecified vectors. The issue affects 6.x releases prior to 6.2.4 on Linux and can be triggered by a crafted request, potentially compromising a...

CVE-2016-2075

Cross-site scripting XSS vulnerability in VMware vRealize Business Advanced and Enterprise 8.x before 8.2.5 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

VMware vRealize Automation Cross-Site Scripting Vulnerability

VMware vRealize Automation is a suite of cloud automation software from VMware. The software supports automated delivery of personalized infrastructure, deployment across multi-vendor, hybrid cloud infrastructures, simplified application release automation and continuous delivery. A cross-site...

VMware Releases Security Updates

VMware has released security updates to address vulnerabilities in VMware vRealize Automation and vRealize Business Advanced and Enterprise. Exploitation of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review...

PT-2016-3600

Name of the Vulnerable Software and Affected Versions VMware vRealize Automation versions prior to 6.2.4 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Recommendations For versions prior to 6.2.4, upda...

VMware vRealize Business Advanced and Enterprise Cross-Site Scripting Vulnerability

VMware vRealize Business formerly known as IT Business Management Suite is a tool from VMware that can be used to visualize and control the cost of cloud computing environments and IT services. The tool provides cloud business management, IT financial management, and service quality management...