June 2020 Patch Tuesday – 128 Vulns, 11 Critical, Sharepoint, Workstation, Adobe Patches

This month’s Microsoft Patch Tuesday addresses 128 vulnerabilities with 11 of them labeled as Critical. The 11 Critical vulnerabilities cover SharePoint server, Browsers, Scripting Engines, Windows, GDI+, OLE and LNK files. Adobe issued patches today for Experience Manager, Flash Player and...

KLA12097 OSI vulnerability in VMware Workstation and Player

Out of bounds read vulnerability vulnerability was found in VMware Workstation and Player. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories VMSA-2020-0012 Related products VMware-Workstation VMware-Player CVE list CVE-2020-3960 unknown Solution...

VMware Workstation 15.x < 15.1.0 / 15.x < 15.5.2 Multiple Vulnerabilities (VMSA-2020-0011)

The version of VMware Workstation installed on the remote Windows host is 15.x prior to 15.1.0 or 15.x prior to 15.5.2. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version...

Insecure Password Update

com.liferay.login.web is vulnerable to insecure password update. During the user password update, it is allowed to update the password via JSONWS without supplying their current password, leading to other attacks such as XSS, session hijacking, an unattended workstation or other vectors...

Vulnerability Spotlight: VMware Workstation 15 denial-of-service vulnerability

Piotr Bania of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered a denial-of-service vulnerability in VMware Workstation 15. VMware allows users to set up virtual machines and operate various operating systems outside of the ones designed for their...

VMware Workstation 15 shader functionality round_ni denial of service vulnerability

Summary An exploitable denial of service vulnerability exists in VMware Workstation 15.5.0 build-14665864. A specially crafted pixel shader can cause a denial of service. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered fro...

CVE-2020-3958

VMware ESXi 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG, VMware Workstation 15.x before 15.5.2 and VMware Fusion 11.x before 11.5.2 contain a denial-of-service vulnerability in the shader functionality. Successful exploitation of this issue may allow attackers with...

CVE-2020-3959

VMware ESXi 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG, VMware Workstation 15.x before 15.1.0 and VMware Fusion 11.x before 11.1.0 contain a memory leak vulnerability in the VMCI module. A malicious actor with local non-administrative access to a virtual machine may be ab...

CVE-2020-3959

VMware ESXi 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG, VMware Workstation 15.x before 15.1.0 and VMware Fusion 11.x before 11.1.0 contain a memory leak vulnerability in the VMCI module. A malicious actor with local non-administrative access to a virtual machine may be ab...

Memory corruption

VMware ESXi 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG, VMware Workstation 15.x before 15.1.0 and VMware Fusion 11.x before 11.1.0 contain a memory leak vulnerability in the VMCI module. A malicious actor with local non-administrative access to a virtual machine may be ab...

Race condition

VMware ESXi 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG, VMware Workstation 15.x before 15.5.2 and VMware Fusion 11.x before 11.5.2 contain a denial-of-service vulnerability in the shader functionality. Successful exploitation of this issue may allow attackers with...

CVE-2020-3959

VMware ESXi 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG, VMware Workstation 15.x before 15.1.0 and VMware Fusion 11.x before 11.1.0 contain a memory leak vulnerability in the VMCI module. A malicious actor with local non-administrative access to a virtual machine may be ab...

CVE-2020-3959

Summary: CVE-2020-3959 affects VMware virtualization products (ESXi, Workstation, Fusion). The vulnerability is a memory leak in the VMCI module that, under local non-administrative VM access, can crash the vmx process and cause a partial denial of service. The initial description specifies affec...

CVE-2020-3958

CVE-2020-3958 affects VMware products (ESXi, Workstation, Fusion): a denial-of-service in the shader functionality. A non-administrative attacker with access to a VM may crash the vmx process, causing a DoS. Affected versions include ESXi 6.7 prior to 670-202004101-SG and ESXi 6.5 prior to 650-20...

CVE-2020-3958

VMware ESXi 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG, VMware Workstation 15.x before 15.5.2 and VMware Fusion 11.x before 11.5.2 contain a denial-of-service vulnerability in the shader functionality. Successful exploitation of this issue may allow attackers with...

KLA12096 Multiple vulnerabilities in VMware Workstation and Player

Multiple vulnerabilities were found in VMware Workstation and Player. Malicious users can exploit these vulnerabilities to cause denial of service. Below is a complete list of vulnerabilities: 1. A memory leak vulnerability in VMCI module can be exploited locally to cause denial of service. 2. A...

VMSA-2020-0012:VMware ESXi, Workstation and Fusion updates address out-of-bounds read vulnerability

Advisory ID: VMSA-2020-0012 CVSSv3 Range: 7.1 Issue Date:2020-06-09 Updated On: 2020-06-09 Initial Advisory CVEs: CVE-2020-3960 Synopsis: VMware ESXi, Workstation and Fusion updates address out-of-bounds read vulnerability CVE-2020-3960 RSS Feed Download PDF Download Text File Share this page on...

VMSA-2020-0011:VMware ESXi, Workstation, Fusion, VMware Remote Console and Horizon Client updates address multiple security vulnerabilities

Advisory ID: VMSA-2020-0011.1 CVSSv3 Range: 3.3-7.3 Issue Date:2020-05-28 Updated On: 2020-07-09 CVEs: CVE-2020-3957, CVE-2020-3958, CVE-2020-3959 Synopsis: VMware ESXi, Workstation, Fusion, VMware Remote Console and Horizon Client updates address multiple security vulnerabilities CVE-2020-3957,...

CVE-2019-15083

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator...

CVE-2019-15083

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator...