CVE-2023-34058

VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate...

PT-2023-6488

Name of the Vulnerable Software and Affected Versions VMware Tools affected versions not specified Description VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges in a target virtual machine may be able to elevate...

PT-2023-8895

Name of the Vulnerable Software and Affected Versions open-vm-tools affected versions not specified Description The issue is related to a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file...

VMware Aria Operations for Logs 8.6.x / 8.8.x / 8.10 / 8.10.2 / 8.12 Authentication Bypass (VMSA-2023-0021)

The version of VMware Aria Operations for Logs formerly VMware vRealize Log Insight running on the remote host is 8.6.x, 8.8.x, 8.10, 8.10.2 or 8.12. It is, therefore, affected by an authentication bypass vulnerability. An unauthenticated, remote attacker can inject files into the operating syste...

open-vm-tools -- Multiple vulnerabilities

VMware reports: This update includes 2 security fixes: High CVE-2023-34058: SAML token signature bypass vulnerability High CVE-2023-34059: File descriptor hijack vulnerability in the vmware-user-suid-wrapper...

UBUNTU-CVE-2023-34058

VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate...

VMware Aria Operations for Logs 8.10.2 / 8.12 Deserialization (VMSA-2023-0021)

The version of VMware Aria Operations for Logs formerly VMware vRealize Log Insight running on the remote host is 8.10.2 or 8.12. It is, therefore, affected by a deserialization vulnerability. An unauthenticated, remote attacker with non-administrative access to the local system can trigger the...

Act Now: VMware Releases Patch for Critical vCenter Server RCE Vulnerability

VMware has released security updates to address a critical flaw in the vCenter Server that could result in remote code execution on affected systems. The issue, tracked as CVE-2023-34048 CVSS score: 9.8, has been described as an out-of-bounds write vulnerability in the implementation of the DCE/R...

Update vCenter Server now! VMWare fixes critical vulnerability

VMWare has issued an update to address one out-of-bounds write and one information disclosure vulnerability in its server management software, vCenter Server. Since there are no in-product workarounds, customers are advised to apply the updates urgently. The affected products are VMware vCenter...

Alert: PoC Exploits Released for Citrix and VMware Vulnerabilities

Virtualization services provider VMware has alerted customers to the existence of a proof-of-concept PoC exploit for a recently patched security flaw in Aria Operations for Logs. Tracked as CVE-2023-34051 CVSS score: 8.1, the high-severity vulnerability relates to a case of authentication bypass...

CVE-2023-34056 VMware vCenter Server Partial Information Disclosure Vulnerability

vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data...

CVE-2023-34056 VMware vCenter Server Partial Information Disclosure Vulnerability

vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data...

CVE-2023-34048 VMware vCenter Server Out-of-Bounds Write Vulnerability

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution...

CVE-2023-34048 VMware vCenter Server Out-of-Bounds Write Vulnerability

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution...

SUSE CVE-2023-5633

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user...

CVE-2023-34048

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution. Recent assessments: ccondon-r7 at January 19, 2024...

VMware vCenter Server Buffer Error Vulnerability

VMware vCenter Server is a suite of server and virtualization management software from VMware. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructures. A security vulnerability exists in VMware...

VMware vCenter Server updates address out-of-bounds write and information disclosure vulnerabilities (CVE-2023-34048, CVE-2023-34056)

3a. VMware vCenter Server Out-of-Bounds Write Vulnerability CVE-2023-34048 vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base sco...

The vulnerability of VMware Fusion’s hypervisor is related to synchronization errors when using shared resources, allowing attackers to increase their privileges.

The vulnerability of VMware Fusion relates to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of VMware Fusion’s hypervisor, related to deficiencies in access control, allows attackers to escalate their privileges.

The vulnerability of VMware Fusion relates to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...