PT-2021-4135

Name of the Vulnerable Software and Affected Versions vRealize Operations Manager API versions 8.x prior to 8.5 Description The issue is related to a Server Side Request Forgery in an endpoint of the vRealize Operations Manager API. An unauthenticated malicious actor with network access can perfo...

PT-2021-4209

Name of the Vulnerable Software and Affected Versions vRealize Operations Manager API versions 8.x prior to 8.5 Description The issue is related to an insecure object reference vulnerability in the vRealize Operations Manager API. This vulnerability can be exploited by a malicious actor with...

PT-2021-4132

Name of the Vulnerable Software and Affected Versions vRealize Operations Manager API versions 8.x prior to 8.5 Description The issue is related to an arbitrary file read vulnerability in the vRealize Operations Manager API. A malicious actor with administrative access can read any arbitrary file...

PT-2021-4136

Name of the Vulnerable Software and Affected Versions vRealize Operations Manager API versions 8.x prior to 8.5 Description The issue concerns a Server Side Request Forgery in an endpoint of the vRealize Operations Manager API. An unauthenticated malicious actor with network access can perform a...

PT-2021-4133

Name of the Vulnerable Software and Affected Versions vRealize Operations Manager versions 8.x prior to 8.5 Description The issue is related to insufficient validation of incoming requests, which can allow a remote attacker to disclose sensitive information. An unauthenticated malicious actor wit...

PT-2021-4134

Name of the Vulnerable Software and Affected Versions vRealize Operations Manager versions 8.x prior to 8.5 Description The issue is related to a broken access control vulnerability in the vRealize Operations Manager API, allowing unauthenticated API access. An unauthenticated malicious actor wit...

VMSA-2021-0019:VMware vRealize Log Insight updates address Cross Site Scripting (XSS) vulnerability

Advisory ID: VMSA-2021-0019 CVSSv3 Range: 6.5 Issue Date:2021-08-24 Updated On: 2021-08-24 Initial Advisory CVEs: CVE-2021-22021 Synopsis: VMware vRealize Log Insight updates address Cross Site Scripting XSS vulnerability CVE-2021-22021 RSS Feed Download PDF Download Text File Share this page on...

VMSA-2021-0018:VMware vRealize Operations updates address multiple security vulnerabilities

Advisory ID: VMSA-2021-0018 CVSSv3 Range: 4.4 - 8.6 Issue Date:2021-08-24 Updated On: 2021-08-24 Initial Advisory CVEs: CVE-2021-22022, CVE-2021-22023, CVE-2021-22024, CVE-2021-22025, CVE-2021-22026, CVE-2021-22027 Synopsis: VMware vRealize Operations updates address multiple security...

The vulnerability of the VMware Identity Manager (vIDM), Workspace ONE Access, Cloud Foundation, and vRealize Suite Lifecycle Manager lies in the transmission of data through an unprotected primary channel, allowing attackers to circumvent existing security restrictions.

The vulnerability of the VMware Identity Manager vIDM, Workspace ONE Access, Cloud Foundation, and vRealize Suite Lifecycle Manager lies in the transmission of data through an unprotected primary channel. Exploiting this vulnerability allows a malicious actor to circumvent existing security...

The vulnerabilities of the VMware Identity Manager (vIDM), vRealize Automation, Workspace ONE Access, Cloud Foundation, and vRealize Suite Lifecycle Manager software are related to insufficient validation of incoming requests. This allows attackers to execute SSRF attacks.

The vulnerabilities of VMware Identity Manager vIDM, vRealize Automation, Workspace ONE Access, Cloud Foundation, and vRealize Suite Lifecycle Manager are related to insufficient validation of incoming requests. Exploiting these vulnerabilities allows a malicious actor to execute an SSRF attack b...

VulnCheck KEV: CVE-2022-22972

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate...

Vmware vRealize Automation 授权问题漏洞

Vmware vRealize Automation is a management tool that provides self-service, supervised multi-cloud automation from Vmware, Inc. An authorization issue vulnerability exists in Vmware vRealize Automation version 7.6, which stems from the software not adequately validating user-supplied input in the...

PT-2021-3779

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE Access and Identity Manager affected versions not specified VMware Identity Manager affected versions not specified vRealize Automation affected versions not specified Cloud Foundation affected versions not specified...

VMSA-2021-0016:VMware Workspace ONE Access, Identity Manager and vRealize Automation address multiple vulnerabilities

Advisory ID: VMSA-2021-0016.2 CVSSv3 Range: 3.7-8.6 Issue Date:2021-08-05 Updated On: 2021-11-12 CVEs: CVE-2021-22002, CVE-2021-22003 Synopsis: VMware Workspace ONE Access, Identity Manager and vRealize Automation address multiple vulnerabilities CVE-2021-22002, CVE-2021-22003 RSS Feed Download P...

Vulnerability fixed in VMware vRealize Business for Cloud

VMware has fixed a vulnerability in virtual appliances of vRealize Business for Cloud. An unauthenticated remote malicious agent could remote user could potentially exploit the vulnerability to execute arbitrary execute arbitrary code. To do so, the malicious party must maliciously send network...

VulnCheck KEV: CVE-2021-21975

Server Side Request Forgery SSRF in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials...

The vulnerability of the management tools for VMware vRealize Business for Cloud lies in insufficient validation of the commands passed to the system, allowing attackers to execute arbitrary commands.

The vulnerability of the management tools for VMware vRealize Business for Cloud relates to insufficient verification of the arguments passed in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the target system remotely...

VMware vRealize Business for Cloud RCE (VMSA-2021-0007)

The version of VMware vRealize Business for Cloud running on the remote host is 7.6.x prior to 7.6.0.46000-17828140. It is, therefore, affected by a remote code execution RCE vulnerability due to an unauthorized end point. A malicious actor with network access may exploit this issue causing...

VMware vRealize Business for Cloud Command Injection Vulnerability

Vmware vRealize Business for Cloud is a software application from Vmware, Inc. It provides an automated way to perform cloud cost analysis, consumption metrics, and cloud comparison and planning, as well as providing cost visibility and business insight so that cloud functions can be run more...

CVE-2021-21984

VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthorised end point. A malicious actor with network access may exploit this issue causing unauthorised remote code execution on vRealize Business for Cloud Virtual Appliance...