14913 matches found
VMware ESXi Security Vulnerabilities
VMware ESXi is a suite of server virtualization platforms from VMware that can be installed directly on physical servers. A security vulnerability exists in VMware ESXi that stems from an authentication bypass vulnerability that could allow an attacker to gain full access to a previously configur...
PT-2024-4541
Name of the Vulnerable Software and Affected Versions VMware ESXi affected versions not specified Description An authentication bypass exists in VMware ESXi. A malicious actor with sufficient Active Directory AD permissions can gain full access to an ESXi host previously configured to use AD for...
CVE-2024-37085: Improper Authentication
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory AD permissions can gain full access to an ESXi host that was previously configured to use AD for user management...
VMware Fusion 12.0.x < 12.2.0 Vulnerability (VMSA-2022-0001.2)
The version of VMware Fusion installed on the remote macOS or Mac OS X host is 12.0.x prior to 12.2.0. It is, therefore, affected by a vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...
CVE-2024-37086: Out-of-bounds Read
VMware ESXi contains an out-of-bounds read vulnerability. A malicious actor with local administrative privileges on a virtual machine with an existing snapshot may trigger an out-of-bounds read leading to a denial-of-service condition of the host...
VMSA-2024-0013:VMware ESXi and vCenter Server updates address multiple security vulnerabilities (CVE-2024-37085, CVE-2024-37086, CVE-2024-37087)
Advisory ID: | VMSA-2024-0013.2 ---|--- Advisory Severity: | Moderate CVSSv3 Range: | 5.3-6.8 Synopsis: | VMware ESXi and vCenter Server updates address multiple vulnerabilities CVE-2024-37085, CVE-2024-37086, CVE-2024-37087 Issue date: | 2024-06-25 Updated on: | 2024-08-12 CVEs | CVE-2024-37085,...
VMware Workstation 16.0.x < 16.2.0 Vulnerability (VMSA-2022-0001.2)
The version of VMware Workstation installed on the remote host is 16.0.x prior to 16.2.0. It is, therefore, affected by a vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable,...
A week in security (June 17 – June 23)
Last week on Malwarebytes Labs: Microsoft Recall delayed after privacy and security concerns Almost everything you always wanted to know about cybersecurity, but were too afraid to ask, with Tjitske de Vries: Lock and Code S05E13 43% of couples experience pressure to share logins and locations,...
PT-2024-4569
Name of the Vulnerable Software and Affected Versions: Hitachi Storage Provider for VMware vCenter versions 3.1.0 through 3.7.3 Description: The issue is related to incorrect default permissions, allowing local users to read and write specific files. This could potentially enable an attacker to...
VMware vCenter Server DCERPC Code Execution
The vulnerability of the DCERPC protocol implementation in the software for managing virtual infrastructure, VMware vCenter Server, arises due to a buffer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted network packet remotely...
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to open redirect vulnerability in VMware Tanzu Spring Framework ( CVE-2024-22243)
Summary Potential open redirect vulnerability in VMware Tanzu Spring Framework CVE-2024-22243 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability has been addressed. Refer to details for additional information. Vulnerability Details...
VMware Address Critical Heap-Overflow and Privilege Escalation Flaws
...
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to VMware Tanzu Spring Boot arbitrary denial of service vulnerability ( CVE-2023-34053)
Summary Potential VMware Tanzu Spring Boot arbitrary denial of service vulnerability CVE-2023-34053 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details...
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to VMware Tanzu Spring Boot arbitrary denial of service vulnerability ( CVE-2023-34053)
Summary Potential VMware Tanzu Spring Boot arbitrary denial of service vulnerability CVE-2023-34053 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details...
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to phishing attacks in VMware Tanzu Spring Framework [CVE-2024-22259]
Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to phishing attacks in VMware Tanzu Spring Framework, caused by an open redirect vulnerability in UriComponentsBuilder CVE-2024-22259. VMware Tanzu Spring Framework is used in our Speech Microservices. This...
PT-2024-6542 · Vmware · Vmware Fusion
Name of the Vulnerable Software and Affected Versions: VMware Fusion versions 13.x before 13.6 Description: The issue is related to insufficient input validation, allowing an attacker to execute arbitrary code in the context of the Fusion application. A malicious actor with standard user privileg...
PT-2024-28232 · Vmware · Vmware Nsx
Name of the Vulnerable Software and Affected Versions: VMware NSX affected versions not specified Description: The issue allows an authenticated malicious actor to exploit a local privilege escalation vulnerability, obtaining permissions from a separate group role than previously assigned. This...
Linux kernel security vulnerabilities
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel, which stems from a vulnerability in the drm/vmwgfx module file descriptor...
Exploit for Code Injection in Vmware Spring_Cloud_Gateway
CVE-2022-22947 A code injection attack on spring cloud gate...
UNC3886 Uses Fortinet, VMware 0-Days and Stealth Tactics in Long-Term Spying
The China-nexus cyber espionage actor linked to the zero-day exploitation of security flaws in Fortinet, Ivanti, and VMware devices has been observed utilizing multiple persistence mechanisms in order to maintain unfettered access to compromised environments. "Persistence mechanisms encompassed...