VMware Patches Critical Session Handling Vulnerability

VMware fixed a critical vulnerability in one of its products this week that if exploited by an attacker, could’ve led to a man-in-the-middle attack. According to an advisory, the problem existed in VMware’s Client Integration plugin, a collection of tools present in a handful of other products th...

CVE-2016-2076: Improper Authentication

Client Integration Plugin CIP in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, which allows remote attackers to hijack sessions via a crafted web site...

VMWare Releases Security Updates

VMware has released security updates to address a vulnerability in vCenter Server, vCloud Director, vRealize Automation Identity Appliance, and the Client Integration Plugin. Exploitation of this vulnerability may allow a remote attacker to obtain sensitive information. Users and administrators a...

Repeated snapshot consolidation requests on VM by Snapshot Hunter

Article Applicability This article specifically applies to a situation where a VM was created using a third-party VDI, fast-provisioning application, or PowerCLI with the -LinkedClone parameter. Challenge Shortly after a backup or replication job runs, multiple Consolidate Snapshot operations are...

VMware Patches Pesky XXE Bug in Flex BlazeDS

VMware has patched an information disclosure vulnerability affecting a number of its products that use Flex BlazeDS. The original vulnerability was discovered and disclosed in August by Matthias Kaiser of Code White GmbH. Researchers there found a XML External Entity flaw in Apache Flex BlazeDS...

VMware Releases Security Updates

VMware has released security updates to address a vulnerability in vCenter, vCloud Director, and Horizon View. Exploitation of this vulnerability may allow an attacker to obtain sensitive information. Users and administrators are encouraged to review VMware Security Advisory VMSA-2015-0008 and...

Release Notes for Veeam Backup & Replication 8.0 Update 2b

More Recent Version Available Please find the latest version of Veeam Backup & Replication here: Veeam Downloads - Latest Version Challenge Release Notes for Veeam Backup & Replication 8.0 Update 2b Cause Please confirm you are running version 8.0.0.807, 8.0.0.817, 8.0.0.831, 8.0.0.917, 8.0.0.201...

KLA10530 JRE update for multiple VMware products

Multiple VMware products were updated to address vulnerabilities in Oracle Java. For details look at KLA10447. Original advisories VMSA advisory KLA10447 Exploitation Public exploits exist for this vulnerability. Related products VMware-unclassified-products CVE list CVE-2014-6593 warning Solutio...

CVE-2014-8373

CVE-2014-8373 affects VMware vCloud Automation Center (vCAC) 6.0.1–6.1.1 where the VMRC Connect (by) Using VMRC function enables an authenticated vCAC user to escalate privileges to administrator on vCenter Server. The vulnerability is tied to the vCAC VMRC functionality and could allow remote pr...

VMware vCloud Automation Center privilege escalation

Privilege escalation via "Connect by Using VMRC" functionality...

CVE-2014-8373: Undefined Security Weakness

The VMware Remote Console VMRC function in VMware vCloud Automation Center vCAC 6.0.1 through 6.1.1 allows remote authenticated users to gain privileges via vectors involving the "Connect by Using VMRC" function...

NEW VMSA-2014-0013 - VMware vCloud Automation Center product updates address a critical remote privilege escalation vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ VMware Security Advisory Advisory ID: VMSA-2014-0013 Synopsis: VMware vCloud Automation Center product updates address a critical remote privilege escalation vulnerability Issu...

VMSA-2014-0013:VMware vCloud Automation Center product updates address a CRITICAL remote privilege escalation vulnerability

VMSA-2014-0013 VMware vCloud Automation Center product updates address a critical remote privilege escalation vulnerability VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2014-0013 VMware Security Advisory Synopsis: VMware vCloud Automation Center product updates address a...

Cisco Nexus 1000V Cross-Site Scripting Vulnerability

A vulnerability in the VMware vCloud Director of the Cisco Nexus 1000V could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack. The vulnerability is due to insufficient input validation of a user-supplied value. An attacker could exploit this...

Cross site scripting

Cross-site scripting XSS vulnerability in the vCloud Director component in Cisco Nexus 1000V InterCloud for VMware allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuq90524...

CVE-2014-3367

Cross-site scripting XSS vulnerability in the vCloud Director component in Cisco Nexus 1000V InterCloud for VMware allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuq90524...

CVE-2014-3367

The CVE-2014-3367 entry affects Cisco Nexus 1000V InterCloud’s vCloud Director component. The root cause is insufficient input validation that allows an attacker to craft a link directing an authenticated user to a malicious site, enabling a reflected XSS attack. Impact described: remote attacker...

CVE-2014-3367: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the vCloud Director component in Cisco Nexus 1000V InterCloud for VMware allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCuq90524...

Input validation

VMware NSX 6.0 before 6.0.6, and vCloud Networking and Security vCNS 5.1 before 5.1.4.2 and 5.5 before 5.5.3, does not properly validate input, which allows attackers to obtain sensitive information via unspecified vectors...

CVE-2014-3796

CVE-2014-3796 concerns an input-validation vulnerability in VMware NSX and vCNS that could disclose sensitive information. Affected versions: NSX Edge 6.0.x prior to 6.0.6; vCNS Edge 5.5 prior to 5.5.3; vCNS Edge 5.1 prior to 5.1.4.2. Root cause is improper input validation, enabling information ...