CVE-2022-39425

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with network access via VRDP to compromise Oracle VM VirtualBox. Successful...

CVE-2022-21620

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...

CVE-2022-39421

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

CVE-2022-39427

CVE-2022-39427 affects Oracle VM VirtualBox before 6.1.40 (Core) on Windows. The root cause is a vulnerability in VirtualBox Core allowing a low-privilege, local attacker with logon to compromise the host, with impact on confidentiality, integrity, and availability (taken over the VirtualBox). Th...

Oracle Virtualization和Oracle VM VirtualBox 安全漏洞

Oracle Virtualization and Oracle VM VirtualBox are both products of Oracle Corporation.Oracle Virtualization is a suite of virtualization solutions. The product is used to unify the management of the entire hardware and software architecture from applications to disks, enabling virtualization fro...

CVE-2022-39422

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.38. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...

Oracle Virtualization和Oracle VM VirtualBox 安全漏洞

Oracle Virtualization and Oracle VM VirtualBox are both products of Oracle Corporation.Oracle Virtualization is a suite of virtualization solutions. It is used to unify the management of the entire hardware and software architecture from applications to disk, enabling virtualization from the...

CVE-2022-21621

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

CVE-2022-39425

CVE-2022-39425 affects Oracle VM VirtualBox (Core) prior to 6.1.40. The vulnerability can be exploited remotely over VRDP by an unauthenticated attacker, potentially leading to takeover of VirtualBox and impacting confidentiality, integrity, and availability. Public disclosures in connected sourc...

CVE-2022-39426

CVE-2022-39426 affects Oracle VM VirtualBox (Core) prior to 6.1.40. The vulnerability allows an unauthenticated attacker with network access via VRDP to compromise VirtualBox, potentially taking over the host. Affected version range is before 6.1.40; remediation is to upgrade to 6.1.40 or later (...

CVE-2022-21620

CVE-2022-21620 affects Oracle VM VirtualBox (Core) prior to 6.1.40. The advisory describes a high-privilege, local attack where an authenticated/logged-in attacker can compromise VirtualBox, potentially taking over the product (scope change may impact other Oracle Virtualization components). Miti...

CVE-2022-39426

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with network access via VRDP to compromise Oracle VM VirtualBox. Successful...

CVE-2022-21621

CVE-2022-21621 affects Oracle VM VirtualBox prior to 6.1.40 (Core). The vulnerability is described as easily exploitable, requiring a logon with high privileges, and can result in a hang or crash (DOS) of VirtualBox. Remediation: upgrade to the 6.1.40 maintenance release (or later).

CVE-2022-39423

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.38. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

CVE-2022-39422

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.38. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...

Citrix Hypervisor Security Bulletin for CVE-2022-33748 & CVE-2022-33749

Several security issues have been identified in Citrix Hypervisor 8.2 LTSR CU1. These are: A malicious privileged user in a guest VM working in collaboration with a malicious privileged user in another guest VM can cause the host to crash or become unresponsive. This issue has the following CVE...

AlmaLinux 8 : open-vm-tools (ALSA-2022:6357)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:6357 advisory. - VMware Tools 12.0.0, 11.x.y and 10.x.y contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest O...

GHSA-2JJQ-X548-RHPV isolated-vm has vulnerable CachedDataOptions in API

Impact If the untrusted v8 cached data is passed to the API through CachedDataOptions, the attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept cachedData payloads from a user...

appmixer (>=1.0.68, <=1.1.0-beta.1) potentially affected by CVE-2022-39266 via isolated-vm (4.3.2)

isolated-vm NPM version 4.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on isolated-vm and may be impacted: - appmixer =1.0.68, =1.1.0-beta.1 Source cves: CVE-2022-39266 Source advisory: OSV:GHSA-2JJQ-X548-RHPV...

isolated-vm has vulnerable CachedDataOptions in API

Impact If the untrusted v8 cached data is passed to the API through CachedDataOptions, the attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept cachedData payloads from a user...