OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

...

Active Exploitation of VMware Horizon Servers

This post is co-authored by Charlie Stafford, Lead Security Researcher. We will update this blog with further information as it becomes available. CVE | Vendor Advisory | AttackerKB | IVM Content | Patching Urgency | Blog's Last Update ---|---|---|---|---|--- CVE-2021-44228 | VMware Advisory |...

Cybercriminals Actively Target VMware vSphere with Cryptominers

Organizations running sophisticated virtual networks with VMware’s vSphere service are actively being targeted by cryptojackers, who have figured out how to inject the XMRig commercial cryptominer into the environment, undetected. Uptycs’ Siddharth Sharma has released research showing threat acto...

Vmware VMware Workstation 输入验证错误漏洞

Vmware VMware Workstation is a set of virtual machine software from Vmware. The software provides virtual machine functionality that can run multiple different operating systems at the same time. A vulnerability exists in Vmware VMware Workstation due to an input validation error vulnerability in...

VMware Server Side Request Forgery in vRealize Operations Manager API

Server Side Request Forgery SSRF in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials...

KLA12441 DoS vulnerability in VMware Workstation

A denial of service vulnerability was found in VMware Workstation. Malicious users can exploit this vulnerability to cause denial of service. Original advisories VMSA-2022-0002 Related products VMware-Workstation VMware-Player CVE list CVE-2022-22938 high Solution Update to the latest version...

VMSA-2022-0002:VMware Workstation and Horizon Client for Windows updates address a denial-of-service vulnerability

Advisory ID: VMSA-2022-0002 CVSSv3 Range: 4.0 Issue Date:2022-01-18 Updated On: 2022-01-18 Initial Advisory CVEs: CVE-2022-22938 Synopsis: VMware Workstation and Horizon Client for Windows updates address a denial-of-service vulnerability CVE-2022-22938 RSS Feed Download PDF Download Text File...

Metasploit Weekly Wrap-Up

Log4Shell goodness Log4Shell made an unfortunate end to 2021 for many organizations, but it also makes for some great additions to Metasploit Framework. Contributors sempervictus, schierlm, righel, timwr and our very own Spencer McIntyre have collaborated to bring us a Log4Shell module that uses...

FBI, NSA and CISA Warns of Russian Hackers Targeting Critical Infrastructure

Amid renewed tensions between the U.S. and Russia over Ukraine and Kazakhstan, American cybersecurity and intelligence agencies on Tuesday released a joint advisory on how to detect, respond to, and mitigate cyberattacks orchestrated by Russian state-sponsored actors. To that end, the Cybersecuri...

NTP time sync issue on VPX running on VMware platform

For Citrix ADC VPX instances deployed on VMware ESXi hypervisor, the Citrix ADC system time might go out of sync and consequently network time protocol NTP synchronization is lost. This problem occurs due to an issue with VMware ACPI timer emulation. tail -f ntpd.log 6 Dec 01:06:23 ntpd42663:...

PT-2022-3346 · Coreos +5 · Ignition +5

Name of the Vulnerable Software and Affected Versions: Ignition versions prior to 2.14.0 Description: A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where...

PT-2022-2184 · Vmware · Vmware Vcenter Server +1

Name of the Vulnerable Software and Affected Versions: VMware vCenter Server affected versions not specified Description: The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server...

Vmware Spring Framework has an unspecified vulnerability

Vmware Spring Framework is an open source Java, JavaEE application framework from Vmware, Inc. The framework helps developers build high-quality applications.Vmware Spring Framework has a security vulnerability that can be exploited by attackers to bypass Spring Framework access restrictions...

Photon OS 3.0: Binutils PHSA-2022-3.0-0348

An update of the binutils package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2022-3.0-0348. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Photon OS 3.0: Bluez PHSA-2021-3.0-0346

An update of the bluez package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0346. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...

Photon OS 3.0: Keepalived PHSA-2022-3.0-0348

An update of the keepalived package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2022-3.0-0348. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Photon OS 3.0: Consul PHSA-2021-3.0-0346

An update of the consul package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0346. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Photon OS 3.0: Pkg PHSA-2021-3.0-0346

An update of the pkg package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0346. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

PT-2022-2186 · Vmware · Vrealize Automation +2

Name of the Vulnerable Software and Affected Versions: VMware Workspace ONE Access affected versions not specified VMware Identity Manager affected versions not specified vRealize Automation affected versions not specified Description: The issue is related to an information disclosure...

Photon OS 3.0: Wireshark PHSA-2022-3.0-0341

An update of the wireshark package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2022-3.0-0341. The text itself is copyright C VMware, Inc...