Security Bulletin: Multiple vulnerabilites in IBM Java Runtime affect IBM Spectrum Protect Snapshot (formerly Tivoli Storage FlashCopy Manager) for VMware (CVE-2017-10115, CVE-2017-10116)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ used by IBM Spectrum Protect Snapshot formerly Tivoli Storage FlashCopy Manager for VMware. These issues were disclosed as part of the IBM Java SDK updates in July 2017. Vulnerability Details CVEID: CVE-2017-10115...

Security Bulletin: Multiple vulnerabilities in the IBM GSKit component of IBM Spectrum Protect Snapshot (formerly Tivoli Storage FlashCopy Manager) for VMware

Summary There are multiple vulnerabilities in the IBM GSKit component of IBM Spectrum Protect Snapshot formerly Tivoli Storage FlashCopy Manager for VMware. IBM Spectrum Protect Snapshot for VMware has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0702 DESCRIPTION: OpenSSL...

Security Bulletin: OpenSSL Vulnerability affects IBM Spectrum Protect Snapshot (formerly Tivoli Storage FlashCopy Manager) for VMware (CVE-2017-3737)

Summary OpenSSL vulnerabilities were disclosed on December 7, 2017 by the OpenSSL Project. OpenSSL, used by IBM Spectrum Protect Snapshot formerly Tivoli Storage FlashCopy Manager for VMware, has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-3737 DESCRIPTION: An unspecified...

Security Bulletin: Vulnerability in IBM Java Runtime affects IBM Spectrum Protect Snapshot for VMware (CVE-2019-2989)

Summary Vulnerabilities in IBM® Runtime Environment Java™ were disclosed as part of the IBM Java SDK updates in October 2019. IBM® Runtime Environment Java™ is used by IBM Spectrum Protect Snapshot formerly Tivoli Storage FlashCopy Manager for VMware. Updated 18 March 2020: Added link to 4.1.6.9...

VMware Cloud Foundation contains an information disclosure vulnerability due to the logging of plaintext credentials within some log files.

3. Information disclosure vulnerability in VMware Cloud Foundation SDDC Manager CVE-2022-22939 VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager...

VMSA-2022-0003:VMware Cloud Foundation contains an information disclosure vulnerability due to the logging of plaintext credentials within some log files

Advisory ID: VMSA-2022-0003.1 CVSSv3 Range: 6.0 Issue Date:2022-01-31 Updated On: 2022-02-14 CVEs: CVE-2022-22939 Synopsis: VMware Cloud Foundation contains an information disclosure vulnerability due to the logging of plaintext credentials within some log files. RSS Feed Download PDF Download Te...

CVE-2022-22938

VMware Workstation 16.x prior to 16.2.2 and Horizon Client for Windows 5.x prior to 5.5.3 contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueType font parser. A malicious actor with access to a virtual machine or remote desktop may exploit this...

CVE-2022-22938

VMware Workstation 16.x prior to 16.2.2 and Horizon Client for Windows 5.x prior to 5.5.3 contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueType font parser. A malicious actor with access to a virtual machine or remote desktop may exploit this...

Denial of service

VMware Workstation 16.x prior to 16.2.2 and Horizon Client for Windows 5.x prior to 5.5.3 contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueType font parser. A malicious actor with access to a virtual machine or remote desktop may exploit this...

CVE-2022-22938

CVE-2022-22938 affects VMware Workstation 16.x (before 16.2.2) and Horizon Client for Windows 5.x (before 5.5.3). The vulnerability lies in the Cortado ThinPrint component’s TrueType font parser, allowing a local attacker with VM or remote desktop access to trigger a denial‑of‑service in the Thin...

CVE-2022-22938

VMware Workstation 16.x prior to 16.2.2 and Horizon Client for Windows 5.x prior to 5.5.3 contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueType font parser. A malicious actor with access to a virtual machine or remote desktop may exploit this...

Initial Access Broker Involved in Log4Shell Attacks Against VMware Horizon Servers

An initial access broker group tracked as Prophet Spider has been linked to a set of malicious activities that exploits the Log4Shell vulnerability in unpatched VMware Horizon Servers. According to new research published by BlackBerry Research & Intelligence and Incident Response IR teams today,...

VMware Workstation 16.x < 16.2.2 DoS (VMSA-2022-0002)

The version of VMware Workstation installed on the remote host is 16.x prior to 16.2.2. It is, therefore, affected by a denial of service DoS vulnerability in the Cortado ThinPrint component's TrueType font parser. A local attacker can exploit this in order to cause the ThinPrint service to stop...

VMware Horizon View Client 5.x < 5.5.3 DoS (VMSA-2022-0002)

The version of VMware Horizon Client for Windows installed on the remote host is less than 5.5.3. It is, therefore, affected by a denial of service DoS vulnerability in the Cortado ThinPrint component's TrueType font parser. A local attacker can exploit this in order to cause the ThinPrint servic...

Analysis and Impact of LockBit Ransomware’s First Linux and VMware ESXi Variant

LockBit ransomware's operators announced the release of its first Linux and ESXi variant in October. With samples also spotted in the wild, we discuss the impact and analysis of this variant...

The Internet’s Most Tempting Targets

The number of exposed assets keeps climbing, but existing security strategies aren’t keeping up. Attack surfaces are getting more complex, and the excruciatingly hard part is figuring out where to focus. For every 1,000 assets on an attack surface, there is often only one that’s truly interesting...

Metasploit Weekly Wrap-Up

Image Credit: https://upload.wikimedia.org/wikipedia/commons/c/c7/Logs.jpg without change while j==shell; Log4j; The Log4j loop continues as we release a module targeting vulnerable vCenter releases. This is a good time to suggest that you check your vCenter releases and maybe even increase the...

VMware vRealize Operations Manager Log4Shell Direct Check (CVE-2021-44228) (VMSA-2021-0028)

Binary data vmwarevrealizeoperationsmanagerlog4shell.nbin...

VMware vCenter Server Unauthenticated Log4Shell JNDI Injection Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMware vCenter Server Unauthenticated JNDI Injection RCE via Log4Shell', 'Description' = %q VMware vCenter Server is affected by the Log4Shell...

VMware vCenter Server Unauthenticated Log4Shell JNDI Injection Remote Code Execution Exploit

VMware vCenter Server is affected by the Log4Shell vulnerability whereby a JNDI string can be sent to the server that will cause it to connect to the attacker and deserialize a malicious Java object. This results in OS command execution in the context of the root user in the case of the Linux...