CVE-2017-4940

The CVE-2017-4940 issue affects the ESXi Host Client component of VMware ESXi. It is a stored cross-site scripting (XSS) vulnerability allowing an attacker to inject Javascript that may execute when other users access the Host Client. Affected product versions; ESXi 6.5 before ESXi650-201712103-S...

CVE-2017-4933

Summary: CVE-2017-4933 affects VMware ESXi (6.5 prior to ESXi650-201710401-BG), VMware Workstation (12.x prior to 12.5.8), and VMware Fusion (8.x prior to 8.5.9). It describes a heap overflow in the VNC component that can be triggered by a specific set of VNC packets in an authenticated VNC sessi...

CVE-2017-4940

The ESXi Host Client in VMware ESXi 6.5 before ESXi650-201712103-SG, 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG contains a vulnerability that may allow for stored cross-site scripting XSS. An attacker can exploit this vulnerability by injecting Javascript, which might get...

CVE-2017-4943

VMware vCenter Server Appliance vCSA 6.5 before 6.5 U1d contains a local privilege escalation vulnerability via the 'showlog' plugin. Successful exploitation of this issue could result in a low privileged user gaining root level privileges over the appliance base OS...

CVE-2017-4941

VMware ESXi 6.0 before ESXi600-201711101-SG, 5.5 ESXi550-201709101-SG, Workstation 12.x before 12.5.8, and Fusion 8.x before 8.5.9 contain a vulnerability that could allow an authenticated VNC session to cause a stack overflow via a specific set of VNC packets. Successful exploitation of this iss...

VMware VNC Dynamic Resolution Request Code Execution Vulnerability(CVE-2017-4933)

Summary An exploitable code execution vulnerability exists in the remote management functionality of VMware . A specially crafted set of VNC packets can cause a heap overflow resulting in heap corruption. An attacker can create a VNC session to trigger this vulnerability. Tested Versions Vase,...

VMware VNC Pointer Decode Code Execution Vulnerability(CVE-2017-4941)

Summary An exploitable code execution vulnerability exists in the remote management functionality of VMware . A specially crafted set of VNC packets can cause a type confusion resulting in stack overwrite, which could lead to code execution. An attacker can initiate a VNC session to trigger this...

Vmware ESXi Host Client Cross-Site Scripting Vulnerability

VMware ESXi is a bare-metal virtualization hypervisor from VMware that is installed directly on a physical server and divides the physical server into multiple virtual machines. The program features less disk space, higher reliability and security. A cross-site scripting vulnerability exists in...

Heap Overflow Vulnerability in Multiple Vmware Products

VMware ESXi, Workstation, and Fusion are all products of VMware, Inc. VMware ESXi is a server virtualization platform that can be installed directly on physical servers; VMware Workstation is a suite of virtual machine software; and Fusion is a suite of virtual machine software that is designed t...

Multiple Vmware Product Stack Overflow Vulnerabilities

VMware ESXi, Workstation, and Fusion are all products of VMware, Inc. VMware ESXi is a server virtualization platform that can be installed directly on physical servers; VMware Workstation is a suite of virtual machine software; and Fusion is a suite of virtual machine software that is designed t...

VMware vCenter Server Appliance Local Elevation of Privilege Vulnerability

The VMware vCenter Server Appliance vCSA is a suite of server and virtualization management software from VMware. The software provides a centralized platform for managing VMware vSphere environments. A local lift vulnerability exists in VMware vCSA. A local attacker could exploit this...

Vulnerability Spotlight: VMWare VNC Vulnerabilities

Today, Talos is disclosing a pair of vulnerabilities in the VNC implementation used in VMWare's products that could result in code execution. VMWare implements VNC for its remote management, remote access, and automation purposes in VMWare products including Workstation, Player, and ESXi which...

vCenter tags collection/assignment using PowerCLI tool

Challenge In some cases, Veeam ONE cannot collect or assign vCenter tags properly on vCenter 5.x versions. You can identify the issue by the following error messages in the Veeam ONE Reporter log files: Failed to execute SOAP command "CInvSvcCreateCategory". Inventory Service was not created. Can...

VMware VNC Dynamic Resolution Request Code Execution Vulnerability

Summary An exploitable code execution vulnerability exists in the remote management functionality of VMware . A specially crafted set of VNC packets can cause a heap overflow resulting in heap corruption. An attacker can create a VNC session to trigger this vulnerability. Tested Versions Vase,...

KLA11164 Multiple vulnerabilities in VMware products

Multiple serious vulnerabilities have been found in VMware products. Malicious users can exploit these vulnerabilities to cause privelege escalation, cross site scripting and arbitrary code execution. 1. A vulnerability, related with using VNC can be exploited remotely via sending specipic VNC...

VMware VNC Pointer Decode Code Execution Vulnerability

Summary An exploitable code execution vulnerability exists in the remote management functionality of VMware . A specially crafted set of VNC packets can cause a type confusion resulting in stack overwrite, which could lead to code execution. An attacker can initiate a VNC session to trigger this...

VMSA-2017-0021:VMware ESXi, vCenter Server Appliance, Workstation and Fusion updates address multiple security vulnerabilities

VMSA-2017-0021 VMware ESXi, vCenter Server Appliance, Workstation and Fusion updates address multiple security vulnerabilities VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2017-0021 VMware Security Advisory Severity: Important VMware Security Advisory Synopsis: VMware ESXi,...

VMware AirWatch Console Access Bypass Vulnerability

VMware AirWatch is a console application for the VMware AirWatch Console AWC, a suite of enterprise mobility management solutions from VMware, Inc. An access bypass vulnerability exists in VMware AWC. An attacker could exploit this vulnerability to obtain end-user device information...

VMware Cloud on AWS - Support, Considerations, and Limitations

Challenge VMware Cloud on AWS is an integrated cloud offering developed by AWS and VMware. It requires specific preparation to enable Veeam Backup & Replication to function with it. Apart from the preparation process and the limitations mentioned at the end of this article, you can interact with...

CVE-2017-4942

VMware AirWatch Console AWC contains a Broken Access Control vulnerability. Successful exploitation of this issue could result in end-user device details being disclosed to an unauthorized administrator...