Immunity Canvas: VREALIZE_VCOFACTORY_DESERIALIZE

Name| vrealizevcofactorydeserialize ---|--- CVE| CVE-2015-6934 Exploit Pack| CANVAS Description| vrealizevcofactorydeserialize Notes| CVE Name: CVE-2015-6934 VENDOR: VMWare NOTES: IMPORTANT NOTE: Any instance of this application running Apache Commons Collections version prior to 3.0 WILL NOT WOR...

CVE-2015-6934

Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery Manager vADM 7.x allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the...

CVE-2015-6934

This CVE (CVE-2015-6934) concerns insecure deserialization in VMware software: VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery Manager 7.x. The root cause is unsafe/deserialization of crafted Java objec...

PT-2015-7412

Name of the Vulnerable Software and Affected Versions VMware vRealize Orchestrator versions 6.x vCenter Orchestrator versions 5.x vRealize Operations versions 6.x vCenter Operations versions 5.x vCenter Application Discovery Manager vADM versions 7.x Description The issue allows remote attackers ...

CVE-2015-6934: Improper Input Validation

Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery Manager vADM 7.x allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the...

VMware vCenter Server updates address an important reflected cross-site scripting issue

3.a Commons-collections deserialization vulnerability A deserialization vulnerability involving Apache Commons-collections and a specially constructed chain of classes exists. Successful exploitation could result in remote code execution, with the permissions of the application using the...

VMSA-2015-0009:VMware vCenter Server updates address an HIGH reflected cross-site scripting issue

VMSA-2015-0009.5 VMware product updates address a critical deserialization vulnerability VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2015-0009.5 VMware Security Advisory Synopsis: VMware product updates address a critical deserialization vulnerability VMware Security...

PT-2015-3314

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 5.5 before U3e and 6.0 before U2a VMware vRealize Automation versions 6.x before 6.2.5 Description The issue is related to the Single Sign-On feature in VMware products, specifically an XML External Entity XXE...

PT-2016-32: XML External Entity Injection in vCenter Server and vRealize Automation

The specialists of the Positive Research center have detected an XML External Entity Injection in vCenter Server. Vulnerability in the Single Sign-On implementation in VMware vCenter Server and vRealize Automation allows attackers to cause a denial of service or obtain sensitive information via a...

KLA10530 JRE update for multiple VMware products

Multiple VMware products were updated to address vulnerabilities in Oracle Java. For details look at KLA10447. Original advisories VMSA advisory KLA10447 Exploitation Public exploits exist for this vulnerability. Related products VMware-unclassified-products CVE list CVE-2014-6593 warning Solutio...