15015 matches found
SUSE-SU-2022:2350-1 Security update for ignition
This update for ignition fixes the following issues: - CVE-2022-1706: Fixed accessible configs from unprivileged containers in VMs running on VMware products bsc1199524. - Update to version 2.14.0...
SUSE-SU-2022:2349-2 Security update for ignition
This update for ignition fixes the following issues: - CVE-2022-1706: Fixed accessible configs from unprivileged containers in VMs running on VMware products bsc1199524. - Update to version 2.14.0...
SUSE-SU-2022:2349-1 Security update for ignition
This update for ignition fixes the following issues: - CVE-2022-1706: Fixed accessible configs from unprivileged containers in VMs running on VMware products bsc1199524. - Update to version 2.14.0...
VMSA-2022-0019:VMware vRealize Log Insight contains multiple stored cross-site scripting vulnerabilities
Advisory ID: VMSA-2022-0019 CVSSv3 Range: 3.9 Issue Date:2022-07-12 Updated On: 2022-07-12 Initial Advisory CVEs: CVE-2022-31654, CVE-2022-31655 Synopsis: VMware vRealize Log Insight contains multiple stored cross-site scripting vulnerabilities RSS Feed Download PDF Download Text File Share this...
VMSA-2022-0018:VMware vCenter Server updates address a server-side request forgery vulnerability
Advisory ID: VMSA-2022-0018 CVSSv3 Range: 5.3 Issue Date:2022-07-12 Updated On: 2022-07-23 CVEs: CVE-2022-22982 Synopsis: VMware vCenter Server updates address a server-side request forgery vulnerability CVE-2022-22982 RSS Feed Download PDF Download Text File Share this page on social media: 1...
VMSA-2022-0020:VMware ESXi addresses Return-Stack-Buffer-UnderfLOW and Branch Type Confusion vulnerabilities
Advisory ID: VMSA-2022-0020.2 CVSSv3 Range: 5.6 Issue Date:2022-07-12 Updated On: 2022-10-25 CVEs: CVE-2022-29901, CVE-2022-28693, CVE-2022-23816, CVE-2022-23825, CVE-2022-26373 Synopsis: VMware ESXi addresses Return-Stack-Buffer-Underflow and Branch Type Confusion vulnerabilities RSS Feed Downlo...
Fedora: Security Advisory for golang-github-vmware-govmomi (FEDORA-2022-fae3ecee19)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
VMware Carbon Black App Control 8.5.x < 8.5.14 / 8.6.x < 8.6.6 / 8.7 < 8.7.4 / 8.8 < 8.8.2 Multiple Vulnerabilities (VMSA-2022-0008)
Multiple vulnerabilities exist in the VMware Carbon Black App Control management server, as follows: - VMware Carbon Black App Control 8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2 contains an OS command injection vulnerability. An authenticated, high...
Race Condition
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H...
A week in security (June 27 – July 3)
Last week on Malwarebytes Labs: Ransomware review: June 2022 AstraLocker 2.0 ransomware isn’t going to give you your files back YTStealer targets YouTube content creators ZuoRAT is a sophisticated malware that mainly targets SOHO routers Amazon Photos vulnerability could have given attackers acce...
[SECURITY] Fedora 36 Update: golang-github-vmware-govmomi-0.24.0-5.fc36
A Go library for interacting with VMware vSphere APIs ESXi and/or vCenter...
Unknown threat groups continues to exploit Log4j in VMware Products
Threat Level Attack Report For a detailed advisory, download the pdf file here Summary An unknown APT group is exploiting the Log4j vulnerability that is affecting VMware Horizon and Unified Access Gateway UAG servers to compromise the system and take over the entire network by deploying malware...
Log4Shell Vulnerability Targeted in VMware Servers to Exfiltrate Data
The Cybersecurity and Infrastructure Security Agency CISA and Coast Guard Cyber Command CGCYBER released a joint advisory warning the Log4Shell flaw is being abused by threat actors that are compromising public-facing VMware Horizon and Unified Access Gateway UAG servers. The VMware Horizon is a...
Log4Shell Vulnerability in VMware Leads to Data Exfiltration and Ransomware
We analyzed cases of a Log4Shell vulnerability being exploited in certain versions of the software VMware Horizon. Many of these attacks resulted in data being exfiltrated from the infected systems. However, we also found that some of the victims were infected with ransomware days after the data...
CISA Log4Shell warning: Patch VMware Horizon installations immediately
CISA and the United States Coast Guard Cyber Command CGCYBER are warning that the threat of Log4Shell hasnt gone away. Its being actively exploited and used to target organisations using VMware Horizon and Unified Access Gateway servers. Log4Shell: what is it? Log4Shell was a zero-day vulnerabili...
Log4Shell Still Being Exploited to Hack VMWare Servers to Exfiltrate Sensitive Data
The U.S. Cybersecurity and Infrastructure Security Agency CISA, along with the Coast Guard Cyber Command CGCYBER, on Thursday released a joint advisory warning of continued attempts on the part of threat actors to exploit the Log4Shell flaw in VMware Horizon servers to breach target networks...
com.dubture.jenkins:digitalocean-plugin (>=0.9, <=0.12), com.inkysea.vmware.vra:vmware-vrealize-automation-plugin (>=1.2.1, <=1.2.3) +8 more potentially affected by CVE-2022-34174 via org.jenkins-ci.main:jenkins-core (1.642.2)
org.jenkins-ci.main:jenkins-core MAVEN version 1.642.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.dubture.jenkins:digitalocean-plugin =0.9, =1.2.1, =0.0.8, =0.6, =2.4.2, =1.13-alpha, =0.1...
Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems
CISA and the United States Coast Guard Cyber Command CGCYBER have released a joint Cybersecurity Advisory CSA to warn network defenders that cyber threat actors, including state-sponsored advanced persistent threat APT actors, have continued to exploit CVE-2021-44228 Log4Shell in VMware Horizon®...
CSRF vulnerability and missing permission check in vmware-vrealize-orchestrator
vmware-vrealize-orchestrator 3.0 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specified URL. Additionally, this HTTP endpoint does not require POST requests, resulting in a...
