14914 matches found
K84583382: VMware Tools vulnerability CVE-2015-5191
Security Advisory Description VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVE-2015-5191 Impact This vulnerability may allow a...
K75111593: BIG-IP VE network interface vulnerability CVE-2020-5939
Security Advisory Description BIG-IP Virtual Edition VE systems on VMware, with an Intel-based 85299 Network Interface Controller NIC card and Single Root I/O Virtualization SR-IOV enabled on vSphere, may fail and leave the Traffic Management Microkernel TMM in a state where it cannot transmit...
K87046687: VMware Tools vulnerability CVE-2022-31676
Security Advisory Description VMware Tools 12.0.0, 11.x.y and 10.x.y contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine. CVE-2022-31676 Impact A local,...
This Week in Spring - February 21, 20223
Hi, Spring fans! Welcome to another installment of This Week in Spring! How're you? I almost forgot today was Tuesday! Here in the US, we had a three day weekend for President's day, and also I've been streaming for a few hours every day or almost every day on my little YouTube channel so the day...
PT-2023-1435
Name of the Vulnerable Software and Affected Versions VMware Carbon Black App Control versions 8.7.x through 8.7.7 VMware Carbon Black App Control versions 8.8.x through 8.8.5 VMware Carbon Black App Control versions 8.9.x prior to 8.9.4 Description The issue is related to an injection...
CVE-2023-20858: Improper Neutralization of Special Elements in Output Used by a Downstream Component
VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying...
CVE-2023-20855
CVE-2023-20855 is an XXE vulnerability in VMware vRealize Orchestrator (affecting vRealize Orchestrator and related products such as vRealize Automation and Cloud Foundation). The root cause is an XML External Entity processing issue that allows a non-administrative user to craft input bypassing ...
CVE-2023-20858
VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying...
PT-2023-1450
Name of the Vulnerable Software and Affected Versions VMware vRealize Orchestrator affected versions not specified Description The issue is related to an XML External Entity XXE vulnerability. A malicious actor with non-administrative access to vRealize Orchestrator may be able to use specially...
CVE-2023-20855
VMware vRealize Orchestrator contains an XML External Entity XXE vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalati...
VMware Carbon Black App Control updates address an injection vulnerability (CVE-2023-20858)
3. Injection Vulnerability CVE-2023-20858 VMware Carbon Black App Control contains an injection vulnerability. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.1...
CVE-2023-20855
VMware vRealize Orchestrator contains an XML External Entity XXE vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalati...
CVE-2023-20855: Improper Restriction of XML External Entity Reference
VMware vRealize Orchestrator contains an XML External Entity XXE vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalati...
CVE-2023-20858
VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying...
CVE-2023-20858
CVE-2023-20858 affects VMware Carbon Black App Control management servers in versions 8.7.x before 8.7.8, 8.8.x before 8.8.6, and 8.9.x before 8.9.4. The issue is described as an injection vulnerability where a user with privileged access to the App Control administration console can supply speci...
VMSA-2023-0005:VMware vRealize Orchestrator update addresses an XML External Entity (XXE) vulnerability
Advisory ID: VMSA-2023-0005 CVSSv3 Range: 8.8 Issue Date:2023-02-21 Updated On: 2023-02-21 Initial Advisory CVEs: CVE-2023-20855 Synopsis: VMware vRealize Orchestrator update addresses an XML External Entity XXE vulnerability CVE-2023-20855 RSS Feed Download PDF Download Text File Share this page...
CVE-2022-37935
HPE OneView for VMware vCenter, in certain circumstances, may disclose the “HPE OneView” Username and Password...
CVE-2022-37935
HPE OneView for VMware vCenter, in certain circumstances, may disclose the “HPE OneView” Username and Password...
CVE-2022-37935
HPE OneView for VMware vCenter is affected by CVE-2022-37935, where under certain circumstances it may disclose the HPE OneView username and password. Affected component: HPE OneView for VMware vCenter; root cause involves insufficient protection of registration data. Impact is confidentiality (h...