VMware vRealize Log Insight Unauthenticated RCE

VMware vRealize Log Insights versions v8.x contains multiple vulnerabilities, such as directory traversal, broken access control, deserialization, and information disclosure. When chained together, these vulnerabilities allow a remote, unauthenticated attacker to execute arbitrary commands on the...

PT-2023-1178

Name of the Vulnerable Software and Affected Versions vRealize Log Insight affected versions not specified Description The issue is related to a broken access control vulnerability in vRealize Log Insight. This vulnerability allows an unauthenticated malicious actor to remotely inject code into...

VMSA-2023-0001:VMware vRealize Log Insight latest updates address multiple security vulnerabilities

Advisory ID: VMSA-2023-0001.1 CVSSv3 Range: 5.3-9.8 Issue Date:2023-01-24 Updated On: 2023-01-31 CVEs: CVE-2022-31706, CVE-2022-31704, CVE-2022-31710, CVE-2022-31711 Synopsis: VMware vRealize Log Insight latest updates address multiple security vulnerabilities CVE-2022-31706, CVE-2022-31704,...

VMware vRealize Network Insight downloadFile Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of VMware vRealize Network Insight. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloadFile function. The issue results from the lack of...

VMware vRealize Operations CaSA Improper Privilege Management Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of VMware vRealize Operations. Authentication is required to exploit this vulnerability. The specific flaw exists within the configuration of CaSA. A crafted administrator command can trigger execution of ...

VMware vRealize Operations CaSA Improper Access Control Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of VMware vRealize Operations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists with...

VMware vRealize Network Insight createSupportBundle Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VMware vRealize Network Insight. Authentication is not required to exploit this vulnerability. The specific flaw exists within the createSupportBundle function. The issue results from the lack of...

The vulnerability of the monitoring tool for VMware vRealize Operations, related to insecure management of privileges, allows a perpetrator to escalate their privileges.

The vulnerability of the monitoring tool for the virtual infrastructure vRealize Operations is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

The vulnerability of the log management tool vRealize Log Insight and the VMware Cloud Foundation virtualization platform arises from insufficient measures taken to protect the structure of the web page. This allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the vRealize Log Insight log management tool and the VMware Cloud Foundation virtualization platform exists due to the lack of security measures taken to protect the structure of their web pages. Exploiting this vulnerability allows a malicious actor to compromise the...

VMware vRealize Operations 8.x < 8.6 Hot Fix 8, 8.10.x < 8.10.1 Multiple Vulnerabilities (VMSA-2022-0034)

The version of VMware vRealize Operations vROps running on the remote host is 8.x prior to 8.6 Hot Fix 8 or 8.10.x prior to 8.10.1. It is, therefore, affected by a multiple vulnerabilities: - A privilege escalation vulnerability exists. An authenticated, remote attacker with administrative...

The vulnerability of the application software interface of the VMware vRealize Network Insight (vRNI) system, related to the possibility of bypassing the directory protection mechanism, allows attackers to access protected information.

The vulnerability of the application software interface of the VMware vRealize Network Insight vRNI development and optimization software infrastructure is related to the possibility of bypassing the catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain...

VMware tackles security flaws in ESXi and vRealize

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary VMware addressed security weaknesses to address a critical-severity vulnerability affecting ESXi, Workstation, Fusion, and Cloud Foundation, as well as a critical-severity command injection flaw...

CVE-2022-31708

vRealize Operations vROps contains a broken access control vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.4...

CVE-2022-31708

vRealize Operations vROps contains a broken access control vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.4...

CVE-2022-31707

vRealize Operations vROps contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2...

CVE-2022-31707

vRealize Operations vROps contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2...

Privilege escalation

vRealize Operations vROps contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2...

Improper access control

vRealize Operations vROps contains a broken access control vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.4...

CVE-2022-31707

vRealize Operations vROps contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2...

CVE-2022-31707

vRealize Operations vROps contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2...