Design/Logic Flaw

VMware vRealize Automation vRA prior to 7.4.0 contains a vulnerability in the handling of session IDs. Exploitation of this issue may lead to the hijacking of a valid vRA user's session...

CVE-2018-6959

VMware vRealize Automation vRA prior to 7.4.0 contains a vulnerability in the handling of session IDs. Exploitation of this issue may lead to the hijacking of a valid vRA user's session...

CVE-2018-6958

VMware vRealize Automation vRA prior to 7.3.1 contains a vulnerability that may allow for a DOM-based cross-site scripting XSS attack. Exploitation of this issue may lead to the compromise of the vRA user's workstation...

Cross site scripting

VMware vRealize Automation vRA prior to 7.3.1 contains a vulnerability that may allow for a DOM-based cross-site scripting XSS attack. Exploitation of this issue may lead to the compromise of the vRA user's workstation...

CVE-2018-6959

VMware vRealize Automation vRA prior to 7.4.0 contains a vulnerability in the handling of session IDs. Exploitation of this issue may lead to the hijacking of a valid vRA user's session...

CVE-2018-6958

Summary: CVE-2018-6958 affects VMware vRealize Automation (vRA) before 7.3.1, via a DOM-based XSS vulnerability that may lead to a compromised vRA user workstation. Affected versions: vRA 7.0.x, 7.1.x, 7.2.x, and 7.3.x before 7.3.1. Root cause: DOM-based XSS in the vRA interface. Impact: potentia...

CVE-2018-6958

VMware vRealize Automation vRA prior to 7.3.1 contains a vulnerability that may allow for a DOM-based cross-site scripting XSS attack. Exploitation of this issue may lead to the compromise of the vRA user's workstation...

CVE-2018-6959

CVE-2018-6959 affects VMware vRealize Automation (vRA) prior to 7.4.0, with a vulnerability in handling of session IDs that may allow hijacking a valid vRA user session. The Nessus/NVE and VMware advisory entries show affected versions up to 7.3.x (7.0.x–7.3.x) and indicate remediation via update...

VMware vRealize Automation Session Hijacking Vulnerability

VMware vRealize Automation vRA is a suite of cloud automation software from VMware. The software supports automated delivery of personalized infrastructure, deployment across multi-vendor, hybrid cloud infrastructures, simplified application release automation and continuous delivery. A session...

VMware Releases Security Updates

VMware has released security updates to address a vulnerability in vRealize Automation. An attacker could exploit this vulnerability to take control of an affected system. NCCIC encourages users and administrators to review the VMware Security Advisory VMSA-2018-0009 and apply the necessary...

VMware vRealize Automation Cross-Site Scripting Vulnerability (CNVD-2018-08694)

VMware vRealize Automation vRA is a suite of cloud automation software from VMware. The software supports automated delivery of personalized infrastructure, deployment across multi-vendor, hybrid cloud infrastructures, simplified application release automation and continuous delivery. A cross-sit...

VMware Spring Framework Remote Code Execution (CVE-2018-1270; CVE-2018-1275)

A remote code execution vulnerability exists in VMware Spring Framework. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

VMware Xenon Authentication Bypass Vulnerability

VMware Xenon is a U.S. VMware VMware, Inc. to write REST open source framework for small services that can act as a host for lightweight asynchronous services. An authentication vulnerability exists in VMware Xenon. A remote attacker could use this vulnerability to bypass the authentication...

CVE-2017-16512

The vagrant update process in Hashicorp vagrant-vmware-fusion 5.0.2 through 5.0.4 allows local users to steal root privileges via a crafted update request when no updates are available...

CVE-2017-16873

It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to escalate to root privileges...

CVE-2017-16839

Hashicorp vagrant-vmware-fusion 5.0.4 allows local users to steal root privileges if VMware Fusion is not installed...

CVE-2017-16839

Hashicorp vagrant-vmware-fusion 5.0.4 allows local users to steal root privileges if VMware Fusion is not installed...

Design/Logic Flaw

The vagrant update process in Hashicorp vagrant-vmware-fusion 5.0.2 through 5.0.4 allows local users to steal root privileges via a crafted update request when no updates are available...

CVE-2017-16512

The vagrant update process in Hashicorp vagrant-vmware-fusion 5.0.2 through 5.0.4 allows local users to steal root privileges via a crafted update request when no updates are available...

CVE-2017-16873

It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to escalate to root privileges...