VMware Workstation 代码注入漏洞

VMware Workstation is a set of virtual machine software from VMware. The software provides the ability to run multiple virtual machines with different operating systems at the same time. A code injection vulnerability exists in VMware Workstation 17.x series versions prior to 17.0.1, which can be...

Vulnerability fixed in VMWare Workstation

VMWare has fixed a vulnerability in VMWare Workstation. A local malicious party could exploit the vulnerability to remove arbitrary delete files from the system on which Workstation is installed. VMWare has released updates to fix the vulnerability in Workstation 17.0.1. For more information, see...

VMware vRealize Log Insight Detection Consolidation

Consolidation of VMware vRealize Log Insight detections. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only include"pluginfeedinfo.inc"; if...

CVE-2023-20854

VMware Workstation 17.x (before 17.0.1) is affected by CVE-2023-20854, an arbitrary file deletion vulnerability that requires local privileges. The issue arises in VMware Workstation and can lead to deletion of arbitrary files on the host running the product. Remediation is to update to version 1...

VMware vRealize Operations 8.6.x < 8.6.4 CSRF (VMSA-2023-0002)

The version of VMware vRealize Operations vROps running on the remote host is 8.6.x prior to 8.6.4. It is, therefore, affected by a CSRF vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenticated victim user. Note that Nessus has not tested for this...

wdc-vcd04.oc.vmware.com Cross Site Scripting vulnerability OBB-3176344

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-1294

Name of the Vulnerable Software and Affected Versions VMware Workstation affected versions not specified Description The issue is related to errors in access control, allowing a malicious actor with local user privileges to delete arbitrary files from the file system of the machine on which the...

KLA20212 DoS vulnerability in VMware Workstation

Arbitrary file deletion vulnerability was found in VMWare Workstation. Malicious users can exploit this vulnerability to cause denial of service, bypass security restrictions. Original advisories VMSA-2023-0003 Exploitation Related products VMware-Workstation CVE list CVE-2023-20854 critical...

CVE-2023-20856

VMware vRealize Operations vROps contains a CSRF bypass vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenticated victim user...

Design/Logic Flaw

VMware vRealize Operations vROps contains a CSRF bypass vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenticated victim user...

VMware vRealize Operations 跨站请求伪造漏洞

VMware vRealize Operations is an application from VMware, Inc. A unified, AI-based platform for private, hybrid, and multi-cloud environments that delivers IT operations management on autopilot. A security vulnerability exists in VMware vRealize Operations vROps version 8.6.x series, which can be...

VMware Releases Security Update for VMware vRealize Operations

VMware released a security update that addresses a cross-site request forgery bypass vulnerability affecting VMware vRealize Operations. A malicious user could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review VMware Security...

CVE-2023-20856

VMware vRealize Operations vROps contains a CSRF bypass vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenticated victim user...

CVE-2023-20856

VMware vRealize Operations vROps contains a CSRF bypass vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenticated victim user...

Vulnerability fixed in VMware vRealize Operations

A vulnerability has been fixed in VMware vRealize Operations. A malicious person with user privileges within the same network is able to able to bypass Cross-Site Request Forgery CSRF protection. As a result, a malicious party may be able to launch a CSRF attack cross-site request forgery attack ...

CVE-2023-20856

CVE-2023-20856 affects VMware vRealize Operations (vROps) CSRF bypass in the 8.6.x line prior to 8.6.4. The vulnerability could allow a malicious authenticated user to perform actions on behalf of another authenticated user. Root cause is CSRF bypass in vROps; impact is high (C&E/I/A) as per CVSS...

CVE-2023-20856: Cross-Site Request Forgery (CSRF)

VMware vRealize Operations vROps contains a CSRF bypass vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenticated victim user...

Actors, Threats and Vulnerabilities 23 January 2023 – 29 January 2023

For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here Hive Pro discovered four actors that have been active in the past week. The first, APT40 and Tick, are well-known Chinese threat actors known for information theft and...

CVE-2022-4441

Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.9.0 before 04.9.1...

CVE-2022-4041

Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.8.0 before 04.9.1...