Fedora: Security Advisory for golang-github-vmware-govmomi (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: golang-github-vmware-govmomi-0.24.0-5.fc36

A Go library for interacting with VMware vSphere APIs ESXi and/or vCenter...

VulnCheck KEV: CVE-2021-21980

The vSphere Web Client FLEX/Flash contains an unauthorized arbitrary file read vulnerability. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information...

GHSA-W589-R335-4F55 SaltStack Salt Improper Certificate Validation

In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers in the vmware.py files does not always validate the SSL/TLS certificate...

GHSA-VQ7P-F4FV-RR5X Jenkins vSphere Plugin disables SSL/TLS certificate validation by default

A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default. vSphere Plugin 2.17 now has SSL/TLS certificate validation enabled by default...

org.jenkins-ci.plugins:job-dsl (>=1.25 <=1.32) potentially affected by CVE-2018-1000151 via org.jenkins-ci.plugins:vsphere-cloud (=1.1.11)

org.jenkins-ci.plugins:vsphere-cloud MAVEN version =1.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:vsphere-cloud and may be impacted: - org.jenkins-ci.plugins:job-dsl =1.25, =1.32 Source cves: CVE-2018-1000151 Source...

Jenkins vSphere Plugin disables SSL/TLS certificate validation by default

A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default. vSphere Plugin 2.17 now has SSL/TLS certificate validation enabled by default...

Jenkins vSphere Plugin Cross-Site Request Forgery vulnerability

A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java,...

org.jenkins-ci.plugins:job-dsl (>=1.25 <=1.32) potentially affected by CVE-2018-1000153 via org.jenkins-ci.plugins:vsphere-cloud (=1.1.11)

org.jenkins-ci.plugins:vsphere-cloud MAVEN version =1.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:vsphere-cloud and may be impacted: - org.jenkins-ci.plugins:job-dsl =1.25, =1.32 Source cves: CVE-2018-1000153 Source...

GHSA-2G32-2J8W-2QGF Jenkins vSphere Plugin Cross-Site Request Forgery vulnerability

A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java,...

VMware vCenter Forge SAML Authentication Credentials

This module forges valid SAML credentials for vCenter server using the vCenter SSO IdP certificate, IdP private key, and VMCA certificates as input objects; you must also provide the vCenter SSO domain name and vCenter FQDN. The module will return a session cookie for the /ui path that grants...

GHSA-48PQ-X3VW-4PQF Jenkins vSphere Plugin incorrect authorization vulnerability

An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java,...

org.jenkins-ci.plugins:job-dsl (>=1.25 <=1.32) potentially affected by CVE-2018-1000152 via org.jenkins-ci.plugins:vsphere-cloud (=1.1.11)

org.jenkins-ci.plugins:vsphere-cloud MAVEN version =1.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:vsphere-cloud and may be impacted: - org.jenkins-ci.plugins:job-dsl =1.25, =1.32 Source cves: CVE-2018-1000152 Source...

Jenkins vSphere Plugin incorrect authorization vulnerability

An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java,...

com.cloudcoreo.plugins:cloudcoreo-deploytime (>=0.1.0 <=0.2.3), com.github.kostyasha.yet-another-docker:yet-another-docker-plugin (>=0.1.0 <=0.1.3) +7 more potentially affected by CVE-2017-2648 via org.jenkins-ci.plugins:ssh-slaves (>=1.10 <=1.13)

org.jenkins-ci.plugins:ssh-slaves MAVEN version =1.10, =0.1.0, =0.1.0, =1.2.8, =2.0.0, =1.3, =1.2.0, =2.9, =2.11, =2.8, =2.19 Source cves: CVE-2017-2648 Source advisory: OSV:GHSA-X654-4WJH-74Q6...

CISA Alert: Top 15 Routinely Exploited Vulnerabilities

The U.S. Cybersecurity & Infrastructure Security Agency has published its report on the top exploited vulnerabilities of 2021. This blog summarizes the report’s findings and how you can use Qualys VMDR to automatically detect and remediate these risks in your enterprise environment. The...

SureBackup VM Power On fails with: "Failed to extend swap file" or "Error: Insufficient resources."

Challenge A SureBackup job, for a VMware environment, fails during the VM Power On step with either of the following errors: Error: Module 'MonitorLoop' power on failed. Module 'MonitorLoop' power on failed. Failed to extend swap file...

The vulnerability of the NSX for vSphere and Cloud Foundation network virtualization platform arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of the NSX for vSphere and Cloud Foundation network virtualization platforms exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability could allow a attacker to execute arbitrary commands...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...