CVE-2023-20886

VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user...

CVE-2023-20886

VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user...

Open redirect

VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user...

CVE-2023-20886

VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user...

CVE-2023-20886

VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user...

CVE-2023-20886

CVE-2023-20886 concerns the VMware Workspace ONE UEM console open redirect. Affected: Workspace ONE UEM console versions prior to 22.3.0.48 (and other listed train versions: 22.6.0.36, 22.9.0.29, 22.12.0.20, 23.2.0.10). Root cause: open redirect that can funnel a user to attacker-controlled pages...

[SECURITY] [DSA 5543-1] open-vm-tools security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5543-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 31, 2023 https://www.debian.org/security/faq -...

Apple, Google, and Microsoft Just Patched Some Spooky Security Flaws

Plus: Major vulnerability fixes are now available for a number of enterprise giants, including Cisco, VMWare, Citrix, and SAP...

VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .

...

CVE-2023-20886: URL Redirection to Untrusted Site

VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user...

PT-2023-6684 · Vmware · Vmware Workspace One Uem

Name of the Vulnerable Software and Affected Versions: VMware Workspace ONE UEM affected versions not specified Description: The issue is related to an open redirect vulnerability in the VMware Workspace ONE UEM console. This vulnerability can be exploited by a malicious actor to redirect a victi...

VMware Workspace ONE UEM console updates address an open redirect vulnerability (CVE-2023-20886)

3. Advisory Details VMware Workspace ONE UEM console contains an open redirect vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.8...

VMware Workspace ONE Input Validation Error Vulnerability

VMware Vmware Workspace One is a platform from VMware that supports cross-device applications for rapid delivery and management of applications. The platform, which includes VMware Horizon and VMware Horizon Cloud, integrates access control, application management, and multi-platform endpoint...

A week in security (October 23 – October 29)

Last week on Malwarebytes Labs: Malvertising via Dynamic Search Ads delivers malware bonanza Octo Tempest cybercriminal group is "a growing concern"—Microsoft Update now! Apple patches a raft of vulnerabilities Patch…later? Safari iLeakage bug not fixed Update vCenter Server now! VMWare fixes...

VMware Releases Advisory for VMware Tools Vulnerabilities

VMware released a security advisory addressing multiple vulnerabilities CVE-2023-34057, CVE-2023-34058 in VMware Tools. A cyber actor could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the VMware advisory...

Dell EMC Storage Integration Tools for VMware Disclosure Information

The vulnerabilities of the Dell EMC storage integration tool with VMware’s virtualization platform, the Dell Storage Integration Tools for VMware DSITV; the data storage management tool that manages Dell EMC storage through VMware vSphere Client; and the virtual machine data replay management too...

Exploit for Authorization Bypass Through User-Controlled Key in Vmware Spring_Security

CVE-2022-31692 A demonstration of a Spring Secu...

Privilege Escalation

open-vm-tools is vulnerable to Privilege Escalation. The vulnerability is a file descriptor hijack within the vmware-user-suid-wrapper allowing a malicious attacker to simulate user inputs...

SAML Token Signature Bypass

open-vm-tools is vulnerable to SAML Token Signature Bypass. An attacker could exploit this vulnerability by tricking a user into opening a specially crafted file or visiting a malicious website. The file or website would contain a specially crafted SAML token that would exploit the flaw in VMware...

Jenkins VMware Lab Manager Plugin SSL Disabling

The vulnerability of the Jenkins VMware Lab Manager Slaves Plugin relates to the disabling of global use of SSL/TLS protocols and identity verification for virtual machine JVM hosts. Exploiting this vulnerability allows a malicious actor to carry out a “man-in-the-middle” attack...