SaltStack Salt Master Server Root Key Disclosure

This module exploits unauthenticated access to the prepauthinfo method in the SaltStack Salt master's ZeroMQ request server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to disclose the root key used to authenticate administrative commands to the master. VMware vRealize Operations...

VMSA-2020-0009:vRealize Operations Application Remote Collector (ARC) addresses Authentication Bypass and Directory Traversal vulnerabilities

Advisory ID: VMSA-2020-0009.1 CVSSv3 Range: 7.5-10.0 Issue Date:2020-05-08 Updated On: 2020-05-15 Initial Advisory CVEs: CVE-2020-11651, CVE-2020-11652 Synopsis: vRealize Operations Application Remote Collector ARC addresses Authentication Bypass and Directory Traversal vulnerabilities...

The vulnerability of the vRealize Log Insight log management tool lies in the lack of security measures for the website structure, allowing attackers to perform cross-site scripting attacks.

The vulnerability of the log management tool vRealize Log Insight is related to the lack of security measures for the website structure. Exploiting this vulnerability could allow a malicious actor to perform a cross-site scripting attack remotely...

The vulnerability of the vRealize Log Insight log management tool lies in insufficient validation of input data, allowing a hacker to redirect users to a malicious website.

The vulnerability of the vRealize Log Insight log management tool is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to redirect users to a malicious website...

VMware vRealize Log Insight 4.x < 8.1.0 XSS Vulnerability (VMSA-2020-0007)

The VMware vRealize Log Insight application running on the remote host is 4.0.0 or later but prior to 8.1.0. It is, therefore, affected by a XSS vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid135923; scriptversion"1.3";...

VMware vRealize Log Insight Cross-Site Scripting Vulnerability (CNVD-2020-27463)

VMware vRealize Log Insight provides real-time log management capabilities for VMware environments. A cross-site scripting vulnerability exists in VMware vRealize Log Insight that originates from the program's inability to properly validate user input. An attacker could exploit the vulnerability ...

VMware vRealize Log Insight Input Validation Error Vulnerability

VMware vRealize Log Insight provides real-time log management capabilities for VMware environments. An input validation error vulnerability exists in VMware vRealize Log Insight, which stems from the program's inability to properly validate user input. An attacker could exploit the vulnerability...

CVE-2020-3953

Cross Site Scripting XSS vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation...

CVE-2020-3954

Open Redirect vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation...

Open redirect

Open Redirect vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation...

CVE-2020-3953

Cross Site Scripting XSS vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation...

CVE-2020-3953

CVE-2020-3953 (and CVE-2020-3954) affect VMware vRealize Log Insight prior to 8.1.0 (and 4.x) due to improper input validation. Root cause: input validation failure enabling Cross Site Scripting (XSS) in the UI. Impact described as stored XSS potentially allowing payloads to execute in other user...

CVE-2020-3954

Open Redirect vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation...

CVE-2020-3954

CVE-2020-3954 is an Open Redirect vulnerability in VMware vRealize Log Insight caused by improper input validation. The VMware VMSA-2020-0007 advisory and accompanying tables indicate impact on vRealize Log Insight 8.x (and 4.x) with Open Redirect exploitable via crafted URLs, enabling phishing-s...

CVE-2020-3953: Improper Input Validation

Cross Site Scripting XSS vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation...

PT-2020-2046

Name of the Vulnerable Software and Affected Versions VMware vRealize Log Insight versions prior to 8.1.0 Description The issue is related to insufficient input validation, which can be exploited by a remote attacker to redirect users to a malicious site. This is due to an Open Redirect...

CVE-2020-3954: Improper Input Validation

Open Redirect vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation...

PT-2020-2045

Name of the Vulnerable Software and Affected Versions VMware vRealize Log Insight versions prior to 8.1.0 Description The issue is related to a Cross Site Scripting XSS vulnerability due to improper input validation, which may allow a remote attacker to perform a cross-site scripting attack...

VMware vRealize Log Insight addresses Cross Site Scripting (XSS) and Open Redirect vulnerabilities (CVE-2020-3953, CVE-2020-3954)

3a. Cross Site Scripting XSS vulnerabilities in vRealize Log Insight due to improper Input validation CVE-2020-3953 vRealize Log Insight does not properly validate user input, resulting in XSS vulnerabilities. VMware has evaluated the severity of this issue to be in the Important severity range...

VMware Releases Security Updates for vRealize Log Insight

VMware has released security updates to address vulnerabilities in VMware vRealize Log Insight. An attacker could exploit these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review VMware...