VMware VNC VMWDynResolution Heap Buffer Overflow (CVE-2017-4933)

A heap buffer overflow vulnerability exists in the VNC component of VMware. The vulnerability is due to an error in processing VMWDynResolution requests...

Security Advisory 0129

Security Advisory 0129 PDF Date: December 23, 2025 Revision | Date | Changes ---|---|--- 1.0 | May 13, 2018 | Initial release 1.1 | December 23, 2025 | Updated to Arista Format NOTICE: VeloCloud is now an Arista product. Arista Networks has reposted this advisory that was originally posted by...

CVE-2017-4952

VMware Xenon 1.x, prior to 1.5.4-CR71, 1.5.77, 1.5.4-CR62, 1.3.7-CR12, 1.1.0-CR0-3, 1.1.0-CR31,1.4.2-CR41, and 1.5.48, contains an authentication bypass vulnerability due to insufficient access controls for utility endpoints. Successful exploitation of this issue may result in information...

Authentication flaw

VMware Xenon 1.x, prior to 1.5.4-CR71, 1.5.77, 1.5.4-CR62, 1.3.7-CR12, 1.1.0-CR0-3, 1.1.0-CR31,1.4.2-CR41, and 1.5.48, contains an authentication bypass vulnerability due to insufficient access controls for utility endpoints. Successful exploitation of this issue may result in information...

CVE-2017-4952

VMware Xenon 1.x, prior to 1.5.4-CR71, 1.5.77, 1.5.4-CR62, 1.3.7-CR12, 1.1.0-CR0-3, 1.1.0-CR31,1.4.2-CR41, and 1.5.48, contains an authentication bypass vulnerability due to insufficient access controls for utility endpoints. Successful exploitation of this issue may result in information...

CVE-2017-4952

CVE-2017-4952 affects VMware Xenon 1.x releases (up to listed builds: 1.5.4-CR7_1, 1.5.7_7, 1.5.4-CR6_2, 1.3.7-CR1_2, 1.1.0-CR0-3, 1.1.0-CR3_1, 1.4.2-CR4_1, 1.5.4_8). The issue is an authentication bypass caused by insufficient access controls on utility endpoints, which can lead to information d...

CVE-2017-4952

VMware Xenon 1.x, prior to 1.5.4-CR71, 1.5.77, 1.5.4-CR62, 1.3.7-CR12, 1.1.0-CR0-3, 1.1.0-CR31,1.4.2-CR41, and 1.5.48, contains an authentication bypass vulnerability due to insufficient access controls for utility endpoints. Successful exploitation of this issue may result in information...

UPDATE: Kali Linux 2018.2 Release!

PenTestIT RSS Feed Second Kali Linux update of this year and this time, it is about the latest Kali Linux 2018.2 release! The last release was made available recently in the month of February. This new release includes all patches, fixes, updates, and improvements since the last release – Kali...

VMware Horizon Security Bypass Vulnerability

VMware Horizon DaaS is a set of virtual desktop platforms from the U.S. company VMware VMware built specifically for delivering desktops and applications as a cloud computing service. The platform provides features such as multi-desktop mode and multi-data center management. A security...

VMware Workstation 12.5.2 - Drag n Drop Use-After-Free (Pwn2Own 2017) (PoC)

char initialdnd = "tools.capability.dndversion 4"; static const int cbObj = 0x100; char seconddnd = "tools.capability.dndversion 2"; char chgver = "vmx.capability.dndversion"; char calltransport = "dnd.transport "; char readstring = "ToolsAutoInstallGetParams"; typedef struct DnDCPMsgHdrV4 char...

CVE-2018-6960

VMware Horizon DaaS 7.x before 8.0.0 contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authentication. Note: In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS...

Authentication flaw

VMware Horizon DaaS 7.x before 8.0.0 contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authentication. Note: In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS...

CVE-2018-6960

VMware Horizon DaaS 7.x before 8.0.0 contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authentication. Note: In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS...

CVE-2018-6960

VMware Horizon DaaS 7.x before 8.0.0 contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authentication. Note: In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS...

CVE-2018-6960

VMware Horizon DaaS (7.x before 8.0.0) is affected by a broken authentication vulnerability that may allow bypass of two-factor authentication when an attacker has a legitimate Horizon DaaS account. The issue is addressed by VMware in VMSA-2018-0010; remediation is to apply the Horizon DaaS updat...

Horizon DaaS update addresses a broken authentication issue

VMware Horizon DaaS Broken authentication issue in Horizon DaaS Horizon DaaS contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authentication. Note: In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS. VMware woul...

Kernel panic error is seen when trying to deploy the OVA file for XenMobile Server on VMware

You receive an error similar to the following one when trying to deploy the OVA file for XenMobile Server installation on to VMware: VFS: Cannot open root device "sda3" or unknown-block0,0: error -6Please append a correct "root=" boot option: here are the available partitions:Kernel panic - not...

Hashicorp vagrant-vmware-fusion local elevation of privilege vulnerability (CNVD-2018-09642)

Hashicorp vagrant-vmware-fusion is a tool for building and managing virtual machine environments on VMware virtual machines developed by HashiCorp, USA. A security vulnerability exists in Hashicorp vagrant-vmware-fusion version 5.0.4. A local attacker could exploit the vulnerability to gain root...

Hashicorp vagrant-vmware-fusion elevation of privilege vulnerability

Hashicorp vagrant-vmware-fusion is a tool for building and managing virtual machine environments on VMware virtual machines developed by HashiCorp, USA. A security vulnerability exists in Hashicorp vagrant-vmware-fusion versions 4.0.25 through 5.0.4. An attacker can exploit the vulnerability to...

Hashicorp vagrant-vmware-fusion local elevation of privilege vulnerability

Hashicorp vagrant-vmware-fusion is a tool for building and managing virtual machine environments on VMware virtual machines developed by HashiCorp, USA. vagrant update is one of the update processes. A security vulnerability exists in the vagrant update process in Hashicorp vagrant-vmware-fusion...