CVE-2022-31686

CVE-2022-31686 affects VMware Workspace ONE Assist prior to version 22.10. The issue is a Broken Authentication Method that could allow an attacker with network access to obtain administrative privileges without authenticating to the application. Impact is described as high (admin access, full co...

CVE-2022-31688

CVE-2022-31688 affects VMware Workspace ONE Assist prior to version 22.10. The vulnerability is a reflected cross-site scripting (XSS) flaw caused by improper sanitization of user input, enabling a malicious actor who has some user interaction to inject JavaScript into the target user’s window. T...

CVE-2022-31685

VMware Workspace ONE Assist contains CVE-2022-31685, an authentication bypass vulnerability in versions prior to 22.10. Affected component: Workspace ONE Assist server. Root cause: authentication bypass allows a network-adjacent attacker to obtain administrative access without authenticating. Imp...

CVE-2022-31689

CVE-2022-31689 describes a session fixation flaw in VMware Workspace ONE Assist prior to version 22.10. A malicious actor with a valid session token could authenticate to the application using that token. Public documents confirm affected versions include 21.x and 22.x, with the issue fixed in 22...

CVE-2022-31688

VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting XSS vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window...

CVE-2022-31685: Improper Authentication

VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application...

CVE-2022-31687: Improper Access Control

VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application...

CVE-2022-31688: Improper Neutralization of Input During Web Page Generation

VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting XSS vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window...

CVE-2022-31686: Improper Authentication

VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application...

CVE-2022-31686

VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application...

CVE-2022-31685

VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application...

CVE-2022-31687

VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application...

CVE-2022-31687

VMware Workspace ONE Assist (VMware) before version 22.10 is affected by a Broken Access Control vulnerability (CVE-2022-31687). Affected component: Workspace ONE Assist server. Root cause: improper access control could allow a malicious actor with network access to obtain administrative privileg...

CVE-2022-31688

VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting XSS vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window...

CVE-2022-31689: Session Fixation

VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authenticate to the application using that token...

Exploit for Code Injection in Vmware Spring_Framework

Target machine bash docker run -itd -p 80:8080 vulfocus/spr...

PT-2022-5796

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE Assist versions prior to 22.10 Description The issue is related to insufficient authentication procedure in VMware Workspace ONE Assist, allowing a remote attacker to elevate their privileges. A malicious actor with networ...

VMware Workspace ONE Assist update addresses multiple vulnerabilities.

3a. Authentication Bypass vulnerability CVE-2022-31685 VMware Workspace ONE Assist contains an Authentication Bypass vulnerability. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. 3b. Broken Authentication Method...

Vulnerabilities fixed in VMware Spring

VMware has fixed vulnerabilities in Spring Security and spring-security-oauth2-client. A malicious party could vulnerabilities potentially exploit them to obtain elevated privileges or to bypass authentication. Only Spring environments using specific configurations are vulnerable. VMware has...

Privilege Escalation in VMware spring-security

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A vulnerability in VMwares Spring Security affects the mapping of permitted scope in spring-security-oauth2-client, allowing privilege escalation...