VMware Harbor Privilege Escalation (VMSA-2019-0015) (CVE-2019-16097)

The remote VMware Harbor cloud native registry is affected by a remote privilege escalation vulnerability. Instances of VMware Harbor with DB as the authentication backend and which allow users to self-register are vulnerable. An authenticated, non-administrator, remote attacker can exploit this ...

VMware Workstation 15.0.x < 15.5.0 Multiple Vulnerabilities (VMSA-2019-0014)

The version of VMware Workstation installed on the remote host is 15.0.x prior to 15.5.0. It is, therefore, affected by the following issues: - A use-after-free error in the virtual sound device that allows a local attacker on the guest machine with low privileges to execute code on the host...

VMware Horizon View Client 5.x < 5.2.0 Use-After-Free (VMSA-2019-0014)

The version of VMware Horizon View Client installed on the remote host is 5.x prior to 5.2.0. It is, therefore, affected by a use-after-free error in the virtual sound device that allows a local attacker on the guest machine with low privileges to execute code on the host. Note that Nessus has no...

ESXi 6.5 / 6.7 Multiple Vulnerabilities (VMSA-2019-0012)

The remote VMware ESXi host is version 6.5 or 6.7 and is affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. C Tenable Network Security, Inc. include'compat.inc'; if description...

VMware Fusion 10.0.x < 10.1.6 / 11.0.x < 11.0.3 Pixel Shader out-of-bounds read/write vulnerabilities (VMSA-2019-0012)

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 10.0.x prior to 10.1.6 or 11.0.x prior to 11.0.3. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported...

VMware Tools 10.2.x / 10.3.x < 10.3.10 Information Disclosure / Denial of Service Vulnerability (VMSA-2019-0009)

The version of VMware Tools installed on the remote Windows host is 10.2.x / 10.3.s prior to 10.3.10. It is, therefore, affected by an information disclosure / denial of service vulnerability due to an out of bounds read vulnerability in the vm3dmp driver which is installed with vmtools. An...

KLA12117 Use after free vulnerability in VMware Workstation and Player

A use after freevulnerability was found in VMware Workstation and Player. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories VMSA-2019-0009 Related products VMware-Workstation VMware-Player CVE list CVE-2019-5525 critical Solution Update to the latest...

ESXi 6.0 / 6.5 / 6.7 Multiple Vulnerabilities (VMSA-2019-0008)(MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)(Remote Check)

The remote VMware ESXi host is version 6.0, 6.5 or 6.7 and is missing a security patch. It is, therefore, missing microcode updates to address the following vulnerabilities: - Microarchitectural Store Buffer Data Sampling MSBDS CVE-2018-12126 - Microarchitectural Load Port Data Sampling MLPDS...

VMware Workstation 15.x < 15.1.0 DLL-hijacking Vulnerability (VMSA-2019-0007)

The version of VMware Workstation installed on the remote host is 15.x prior to 15.1.0. It is, therefore, affected by DLL-hijacking vulnerability. An authenticated, attacker can exploit this to gain privileged or administrator access to the host system. C Tenable Network Security, Inc...

KLA12116 PE vulnerability in VMware Workstation and Player

A DLL hijacking vulnerability was found in VMware Workstation and Player. Malicious users can exploit this vulnerability to gain privileges. Original advisories VMSA-2019-0007 Related products VMware-Workstation VMware-Player CVE list CVE-2019-5526 critical Solution Update to the latest version...

KLA11437 Multiple vulnerabilities in VMware products

Multiple vulnerabilities were found in VMware products. Malicious users can exploit these vulnerabilities to gain privileges. Below is a complete list of vulnerabilities: 1. Vulnerability related to VMX process can be exploited remotely to gain privileges; 2. Vulnerability related to COM classes...

VMware Workstation 14.x < 14.1.5 / 15.x < 15.0.2 Virtual Network Integer Overflow Vulnerability (VMSA-2018-0030)

The version of VMware Workstation installed on the remote host is 14.x prior to 14.1.5 or 15.x prior to 15.0.2. It is, therefore, affected by an integer overflow vulnerability in the virtual network devices. An attacker with access to a guest system may be able to execute code on the host system ...

VMware Fusion 10.x < 10.1.5 / 11.x < 11.0.2 Virtual Network Integer Overflow Vulnerability (VMSA-2018-0030) (macOS)

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 10.x prior to 10.1.5 or 11.x prior to 11.0.2. It is, therefore, affected by integer overflow vulnerability in the virtual network devices. An attacker with access to a guest system may be able to execute code on the ho...

VMware Releases Security Updates

VMware has released security updates to address a vulnerability in Workstation and Fusion. An attacker could exploit this vulnerability to take control of an affected system. NCCIC encourages users and administrators to review VMware Security Advisory VMSA-2018-0030 and apply the necessary update...

VMware Workstation 14.x < 14.1.1 Denial of Service Vulnerability (VMSA-2018-0008)

The version of VMware Workstation installed on the remote host is 14.x prior to 14.1.1. It is, therefore, affected by denial of service vulnerability which can be triggered by opening a large number of VNC sessions. In order for exploitation to be possible, VNC feature must be manually enabled. C...

VMware Fusion 10.x < 10.1.1 Denial of Service Vulnerability (VMSA-2018-0008) (macOS)

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 10.x prior to 10.1.1. It is, therefore, affected by a denial of service vulnerability which can be triggered by opening a large number of VNC sessions. In order for exploitation to be possible, VNC feature must be...

VMware vRealize Log Insight 4.6.x < 4.6.2 / 4.7.x < 4.7.1 Authorization Bypass Vulnerability (VMSA-2018-0028)

The VMware vRealize Log Insight application running on the remote host is 4.6.x 4.6.2 or 4.7.x 4.7.1. It is, therefore, affected by an authorization bypass vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid119015; scriptversion"1.4";...

VMware Workstation 14.x < 14.1.4 / 15.x < 15.0.1 vmxnet3 Guest-to-Host Code Execution Vulnerability (VMSA-2018-0027)

The version of VMware Workstation installed on the remote host is 14.x prior to 14.1.4 or 15.x prior to 15.0.1. It is, therefore, affected by an uninitialized stack memory usage vulnerability in the vmxnet3 network adapter. An attacker with access to a guest system may be able to execute code on...

ESXi 6.0 / 6.5 / 6.7 Multiple Vulnerabilities (VMSA-2018-0027) (Remote Check)

The remote VMware ESXi host is version 6.0, 6.5, or 6.7 and is missing a security patch. It is, therefore, vulnerable to multiple vulnerabilities. Leveraging the most severe of these vulnerabilities could allow an attacker to execute arbitrary code on the host from the security context of an...

VMware vRealize Automation 6.x / 7.x Information Disclosure Vulnerability (VMSA-2018-0021

The version of VMware vRealize Automation installed on the remote host is 6.x or 7.x. It is, therefore, affected by an information disclosure vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid112209; scriptversion"1.5";...