Security Bulletin: IBM Upward Integration Modules (UIM) is affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details: CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an...

Security Bulletin: IBM PureApplication System is affected by vulnerabilities in VMWare component (CVE-2018-6981 CVE-2018-6982)

Summary There are vulnerabilities reported in the VMWare component that is used by IBM PureApplication System. IBM has released Version 2.2.5.3 for IBM PureApplication System, in response to CVE-2018-6981 and CVE-2018-6982. The following vulnerabilities have been addressed by IBM PureApplication...

Security Bulletin: IBM PureApplication System is affected by a vulnerability in VMWare component (CVE-2018-6974)

Summary A vulnerability is reported in the VMWare component, and this component is used by IBM PureApplication System. IBM has released Version 2.2.5.3 for IBM PureApplication System, in response to CVE-2018-6974. IBM PureApplication System has addressed the applicable CVE. Vulnerability Details...

Security Bulletin: IBM PureApplication System is affected by a vulnerability in VMWare component (CVE-2018-6972)

Summary There is a vulnerability in the VMWare component that is used by IBM PureApplication System. The following vulnerability has been addressed. Vulnerability Details CVEID: CVE-2018-6972 DESCRIPTION: VMware ESXi, Workstation, and Fusion are vulnerable to a denial of service, caused by a NULL...

VMware ESX / ESXi Web-Based Datastore Browser Default Credentials

Nessus was able to log in to the remote VMware ESX / ESXi Web-Based Datastore Browser using a default set of administrative credentials. A remote attacker could utilize these credentials to access virtual machine and virtual disk files. C Tenable Network Security, Inc. include"compat.inc"; if...

VMware ESX / ESXi host Directory Configuration Files Information Disclosure

The remote VMware ESX / ESXi host is making available configuration files in the /host directory on the web interface. These contain sensitive host configuration information and should not be remotely accessible. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid121351;...

VMware ESX / ESXi Remotely Accessible Method Object Browser API

The remote VMware ESX / ESXi host has a Method Object Browser API accessible in the /mob directory on the web interfaces. This is disabled by default. If enabled, the MOB allows remote attackers to invoke methods on VMware ESX / ESXi objects, including create and destroy. This can allow a remote...

VMware ESXi Login Failed For Authenticated Checks

It was NOT possible to login into the ESXi SOAP API via HTTP using the provided VMware ESXi credentials. Hence authenticated checks are NOT enabled. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

VMware ESXi Login Successful For Authenticated Checks

It was possible to login into the ESXi SOAP API via HTTP using the provided VMware ESXi credentials. Hence authenticated checks are enabled. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Qualys Policy Compliance Notification: Policy Library Update

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

The vulnerability of the management tool for virtual infrastructure, VMware vCenter Server, related to the unencrypted data transmission process, allows attackers to access confidential information.

The vulnerability of the VMware vCenter Server virtualization infrastructure relates to the unencrypted data transfer between storage repositories. Exploiting this vulnerability can allow an attacker to gain access to confidential information during the movement of a virtual machine between stora...

Privilege Escalation

cfme-gemset is vulnerable to privilege escalation attacks. The vulnerability exists as a flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC VMWare Remote Console functions that may not be appropriate fo...

Denial Of Service (DoS)

openstack-nova is vulnerable to denial of service DoS attacks. The vulnerability exists as the VMWare driver in OpenStack Compute Nova before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service resource consumption by putting the VM into the rescue...

Authorization Bypass

openstack-nova is vulnerable to authorization bypass attacks. The vulnerability exists through a race condition in the VMware driver in OpenStack Compute Nova before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance that...

Check Point CloudGuard Controller fails to connect to a VMware vCenter Data Center in R80.20.M2

...

Zerodium Offers to Buy Zero-Day Exploits at Higher Prices Than Ever

Well, there's some good news for hackers and vulnerability hunters, though terrible news for tech manufacturers! Exploit vendor Zerodium is now willing to offer significantly higher payouts for full, working zero-day exploits that allow stealing of data from WhatsApp, iMessage and other online ch...

VMware Workstation/Player < 12.5.5 - Local Privilege Escalation

!/bin/bash VMware Workstation Local Privilege Escalation exploit CVE-2017-4915 - https://www.vmware.com/security/advisories/VMSA-2017-0009.html - https://www.exploit-db.com/exploits/42045/ Affects: - VMware Workstation Player "$VMDIR/$RANDSTR.c" include include include include include include...

VMware WorkstationPlayer 12.5.5 - Local Privilege Escalation

VMware WorkstationPlayer 12.5.5 - Local Privilege Escalation !/bin/bash VMware Workstation Local Privilege Escalation exploit CVE-2017-4915 - https://www.vmware.com/security/advisories/VMSA-2017-0009.html - https://www.exploit-db.com/exploits/42045/ Affects: - VMware Workstation Player...

The vulnerability of VMware Workstation and VMware Fusion hypervisors arises from numerical overflow conditions, allowing an attacker to execute arbitrary code.

The vulnerability of VMware Workstation and VMware Fusion hypervisors is caused by a numerical overflow condition. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

VMware vRealize Operations Manager 6.6.x < 6.6.1.11286876 / 6.7.x < 6.7.0.11286837 / 7.x < 7.0.0.11287810 Local Privilege Escalation Vulnerability (VMSA-2018-0031)

The version of VMware vRealize Operations vROps Manager running on the remote web server is 6.6.x prior to 6.6.1.11286876, 6.7.x prior to 6.7.0.11286837, or 7.x prior to 7.0.0.11287810. It is, therefore, affected by a privilege escalation vulnerability due to improper permissions of support...