Inclusion of Sensitive Information in Log Files

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log...

CVE-2020-5939

In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition VE systems on VMware, with an Intel-based 85299 Network Interface Controller NIC card and Single Root I/O Virtualization SR-IOV enabled on vSphere, may fail and leave the...

CVE-2020-5939

In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition VE systems on VMware, with an Intel-based 85299 Network Interface Controller NIC card and Single Root I/O Virtualization SR-IOV enabled on vSphere, may fail and leave the...

CVE-2020-27688

RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt method from VISKD.cs from the RVTools.exe executable allows for decrypting the encrypted passwords. The...

CVE-2020-27688

RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt method from VISKD.cs from the RVTools.exe executable allows for decrypting the encrypted passwords. The...

Design/Logic Flaw

RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt method from VISKD.cs from the RVTools.exe executable allows for decrypting the encrypted passwords. The...

CVE-2020-27688

RVTools 4.0.6 is affected by CVE-2020-27688: RVToolsPasswordEncryption.exe uses a static IV and key for encryption, and the Decrypt() method in VISKD.cs within RVTools.exe can decrypt the stored passwords. This creates a risk that passwords in configuration files could be recovered by anyone with...

CVE-2020-27688

RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt method from VISKD.cs from the RVTools.exe executable allows for decrypting the encrypted passwords. The...

F5 BIG-IP VE Resource Management Error Vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A resource management error vulnerability exists in the F5 BIG-IP VE product that stems from being enabled on vSphere SR-IOV,...

Information Disclosure

github.com/kubernetes/kubernetes is vulnerable to information disclosure. When using using VSphere as a cloud provider a with logging level set to 4 or above, VSphere cloud credentials will are leaked in the cloud controller manager's log...

CVE-2020-8563

A flaw was found in kubernetes. Clusters running on VSphere, using VSphere as a cloud provider a with logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. Mitigation Ensure that the logging level is below 4. Additionally, protect...

Secret leaks in kube-controller-manager when using vSphere provider

CVSS Rating: 5.6 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Medium In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. Am I vulnerable? If you are using VSphere as a clo...

VMworld 2020: Delivering Intrinsic Security to the World’s Digital Infrastructure

A year ago, we bet big, with a vision to truly disrupt the security industry — and ultimately help more customers stay safe from cyber attacks. The VMware acquisition of Carbon Black created a massive opportunity to leverage infrastructure and control points in new ways to make security intrinsic...

Introducing VMware Carbon Black Cloud Workload™

If you know Carbon Black, you know that we helped invent Endpoint Detection and Response EDR and pioneered the field of next-generation anti-virus NGAV and malware protection. If you know VMware, you know we helped invent virtualization and have championed moving core business servers and service...

Azure VMware Solution Support — Considerations and Limitations

Challenge Azure VMware Solution AVS is a VMware Cloud Verified offering that requires specific considerations to work with Veeam Backup & Replication. Aside from the listed instructions and limitations below, you can use AVS with Veeam Backup & Replication like you would any other VMware vSphere...

Top Three Demos at VMworld 2020: Security, Threat Hunting, and Beyond

VMworld 2020 Sept. 29- Oct. 1 is fast approaching. This year, and for the first time ever, VMworld will showcase a new intrinsic security track featuring 50+ sessions on the future of workspace and workload security. Attendees will have the opportunity to participate in hands-on workshops, hunt f...

Kubernetes: secret leaks in vsphere cloud controller manager log

Report Submission Form Summary: When create k8s cluster over vsphere and enable vsphere as cloud provider. With logging level set to 4 or above, secret information will be printed out in the cloud controller manager's log. Kubernetes Version: 1.18.6 Component Version: legacy cloud provider Steps ...

CVE-2020-8575

Active IQ Unified Manager for VMware vSphere and Windows versions prior to 9.5 are susceptible to a vulnerability which allows administrative users to cause Denial of Service DoS...

CVE-2020-8575

Active IQ Unified Manager for VMware vSphere and Windows versions prior to 9.5 are susceptible to a vulnerability which allows administrative users to cause Denial of Service DoS...

CVE-2020-8575

CVE-2020-8575 affects NetApp Active IQ Unified Manager for VMware vSphere and Windows prior to 9.5. Multiple connected documents (Red Hat, CNVD, CVE lists) consistently describe a vulnerability that allows administrative users to cause Denial of Service (DoS). The precise root cause, vulnerable c...