VMware Workspace ONE Assist update addresses multiple vulnerabilities.

3a. Authentication Bypass vulnerability CVE-2022-31685 VMware Workspace ONE Assist contains an Authentication Bypass vulnerability. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. 3b. Broken Authentication Method...

VMware Tanzu Application Service for VMs updates address a denial-of-service vulnerability (CVE-2021-22101)

3a. VMware Tanzu Application service for VMs updates address a denial-of-service vulnerability CVE-2021-22101 VMware Tanzu Application Service for VMs uses Cloud Controller CAPI from Cloud Foundry which is vulnerable to an unauthenticated denial-of-serviceDoS vulnerability. VMware has evaluated...

VMSA-2021-0007:VMware vRealize Business for Cloud updates address a remote code execution vulnerability

Advisory ID: VMSA-2021-0007 CVSSv3 Range: 9.8 Issue Date:2021-05-05 Updated On: 2021-05-05 Initial Advisory CVEs: CVE-2021-21984 Synopsis: VMware vRealize Business for Cloud updates address a remote code execution vulnerability CVE-2021-21984 RSS Feed Download PDF Download Text File Share this pa...

VMware App Volumes patches address Stored Cross-Site Scripting (XSS) vulnerability (CVE-2020-3975)

3a. Advisory Details VMware App Volumes does not correctly validate user input when creating and editing applications or creating storage groups. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.5...

VMware Horizon Client, VMRC, VMware Workstation and Fusion updates address use-after-free and privilege escalation vulnerabilities (CVE-2019-5543, CVE-2020-3947, CVE-2020-3948)

3a. Use-after-free vulnerability in vmnetdhcp CVE-2020-3947 VMware Workstation and Fusion contain a use-after vulnerability in vmnetdhcp.VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3. 3b. Local Privilege escalation...

VMSA-2019-0012:VMware ESXi, Workstation and Fusion updates address out-of-bounds read/write vulnerabilities

VMware Security Advisories Advisory ID| VMSA-2019-0012 ---|--- Advisory Severity| Important CVSSv3 Range| 6.3-8.5 Synopsis| VMware ESXi, Workstation and Fusion updates address out-of-bounds read/write vulnerabilities CVE-2019-5521, CVE-2019-5684 Issue Date| 2019-08-02 Updated On| 2019-08-02 Initi...

VMware product updates resolve mishandled file descriptor vulnerability in runc container runtime.

VMware product updates resolve mishandled file descriptor vulnerability in runc container runtime. Successful exploitation of this issue may allow a malicious container to overwrite the contents of a host's runc binary and execute arbitrary code. Exploitation of this vulnerability requires the...

VMware ESX third party updates for Service Console

a. Service Console update for NSSdb The service console package NSSdb is updated to version nssdb-2.2-35.4.el55. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the name CVE-2010-0826 to this issue. Column 4 of the following table lists the action required to remediate...

ESX Service Console updates for samba and acpid

a. Service Console update for samba to 3.0.33-3.15.el54.1This update changes the samba packages to samba-client-3.0.33-3.15.el54.1 and samba-common-3.0.33-3.15.el54.1. These versions include fixes for security issues that were first fixed in samba-client-3.0.33-0.18.el48 and...

VMSA-2024-0005:VMware Workstation and Fusion updates address an out-of-bounds read vulnerability (CVE-2024-22251)

Advisory ID: | VMSA-2024-0005 ---|--- Advisory Severity: | Moderate CVSSv3 Range: | 5.9 Synopsis: | VMware Workstation and Fusion updates address an out-of-bounds read vulnerability CVE-2024-22251 Issue date: | 2024-02-27 Updated on: | 2024-02-27 Initial Advisory CVEs | CVE-2024-22251 1. Impacted...

VMware Aria Operations for Networks updates address multiple vulnerabilities. (CVE-2023-20887, CVE-2023-20888, CVE-2023-20889)

3a. Aria Operations for Networks Command Injection Vulnerability CVE-2023-20887 Aria Operations for Networks contains a command injection vulnerability. VMware has evaluated the severity of this issue to be in the critical severity range with a maximum CVSSv3 base score of 9.8. 3b. Aria Operation...

VMSA-2021-0028:VMware Response to Apache Log4j Remote Code Execution Vulnerabilities

Advisory ID: VMSA-2021-0028.13 CVSSv3 Range: 9.0-10.0 Issue Date:2021-12-10 Updated On: 2022-04-14 CVEs: CVE-2021-44228, CVE-2021-45046 Synopsis: VMware Response to Apache Log4j Remote Code Execution Vulnerabilities CVE-2021-44228, CVE-2021-45046 RSS Feed Download PDF Download Text File Share thi...

VMware vCenter Server updates address a privilege escalation vulnerability (CVE-2021-22048)

3. VMware vCenter Server IWA privilege escalation vulnerability CVE-2021-22048 The vCenter Server contains a privilege escalation vulnerability in the IWA Integrated Windows Authentication authentication mechanism. VMware has evaluated the severity of this issue to be in the Important severity...

VMware Workspace ONE UEM console patches address a cross-site scripting vulnerability (CVE-2021-21990)

3. Cross Site Scripting XSS vulnerability in VMware Workspace ONE UEM console CVE-2021-21990 VMware Workspace ONE UEM console does not validate an incoming request during device enrollment.VMware has evaluated the severity of this issue to be in the low severity range with a maximum CVSSv3 base...

VMware ESXi, Workstation, Fusion and Cloud Foundation updates address a denial of service vulnerability (CVE-2020-3999)

3a. Denial-of-Service Vulnerability due to improper input validation CVE-2020-3999 VMware ESXi, Workstation and Fusion contain a denial of service vulnerability due to improper input validation in GuestInfo. VMware has evaluated the severity of this issue to be in the Low severity range with a...

VMware vSphere, ESX and ESXi updates to third party libraries

a. vCenter Server and ESX userworld update for OpenSSL library The userworld OpenSSL library is updated to version openssl-0.9.8y to resolve multiple security issues.The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the names CVE-2013-0169 and CVE-2013-0166 to these...

VMware ESX patches for DHCP, Service Console kernel, and JRE resolve multiple security issues

a. Service Console update for DHCP and third party library update for DHCP client. DHCP is an Internet-standard protocol by which a computer can be connected to a local network, ask to be given configuration information, and receive from a server enough information to configure itself as a member...

VMSA-2025-0009 : VMware Cloud Foundation updates address multiple vulnerabilities (CVE-2025-41229, CVE-2025-41230, CVE-2025-41231)

Advisory ID: | VMSA-2025-0009 ---|--- Advisory Severity: | Important CVSSv3 Range: | 7.3-8.2 Synopsis: | VMware Cloud Foundation updates address multiple vulnerabilities CVE-2025-41229, CVE-2025-41230, CVE-2025-41231 Issue date: | 2025-05-20 Updated on: | 2025-05-20 Initial Advisory CVEs |...

VMSA-2025-0001: VMware Aria automation update addresses a server side request forgery vulnerability (CVE-2025-22215)

Advisory ID: | VMSA-2025-0001 ---|--- Advisory Severity: | Moderate CVSSv3 Range: | 4.3 Synopsis: | VMware Aria Automation update addresses a server side request forgery vulnerability CVE-2025-22215 Issue date: | 2025-01-07 Updated on: | 2025-01-07 CVEs | CVE-2025-22215 1. Impacted Products VMwar...

VMware SD-WAN by VeloCloud updates address SQL-injection vulnerability (CVE-2020-3973)

3a. Advisory Details The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. VMware has evaluated the severity of this issue to be in the important severity range with a maximum CVSSv3 base score of 8.5...

VMSA-2020-0017:VMware Fusion, VMware Remote Console and Horizon Client updates address a privilege escalation vulnerability

Advisory ID: VMSA-2020-0017 CVSSv3 Range: 7.8 Issue Date:2020-07-09 Updated On: 2020-07-09 Initial Advisory CVEs: CVE-2020-3974 Synopsis: VMware Fusion, VMware Remote Console and Horizon Client updates address a privilege escalation vulnerability CVE-2020-3974 RSS Feed Download PDF Download Text...

VMSA-2020-0012:VMware ESXi, Workstation and Fusion updates address out-of-bounds read vulnerability

Advisory ID: VMSA-2020-0012 CVSSv3 Range: 7.1 Issue Date:2020-06-09 Updated On: 2020-06-09 Initial Advisory CVEs: CVE-2020-3960 Synopsis: VMware ESXi, Workstation and Fusion updates address out-of-bounds read vulnerability CVE-2020-3960 RSS Feed Download PDF Download Text File Share this page on...

VMware vRealize Log Insight addresses Cross Site Scripting (XSS) and Open Redirect vulnerabilities (CVE-2020-3953, CVE-2020-3954)

3a. Cross Site Scripting XSS vulnerabilities in vRealize Log Insight due to improper Input validation CVE-2020-3953 vRealize Log Insight does not properly validate user input, resulting in XSS vulnerabilities. VMware has evaluated the severity of this issue to be in the Important severity range...

vSphere Data Protection (VDP) update addresses SSH key-based authentication issue

VDP SSH key-based authentication issue VDP contains a private SSH key with a known password that is configured to allow key-based authentication. Exploitation of this issue may allow an unauthorized remote attacker to log into the appliance with root privileges. VMware would like to thank Marc...

VMSA-2015-0002:VMware vSphere Data Protection product update addresses a certificate validation vulnerability.

VMSA-2015-0002 VMware vSphere Data Protection product update addresses a certificate validation vulnerability. VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2015-0002 VMware Security Advisory Synopsis: VMware vSphere Data Protection product update addresses a certificate...

VirtualCenter Update 4 and ESX patch update Tomcat to version 5.5.27

a. Update for VirtualCenter and ESX patch update Apache Tomcat version to 5.5.27Update for VirtualCenter and ESX patch update the Tomcat package to version 5.5.27 which addresses multiple security issues that existed in the previous version of Apache Tomcat. The Common Vulnerabilities and Exposur...

Several critical security vulnerabilities have been addressed in the newest releases of VMware's hosted product line

a. Host to guest shared folder HGFS traversal vulnerabilityOn Windows hosts, if you have configured a VMware host to guest shared folder HGFS, it is possible for a program running in the guest to gain access to the host's file system and create or modify executable files in sensitive locations...

VMSA-2024-0015: VMware Cloud Director Object Storage Extension addresses an Insertion of Sensitive Information vulnerability (CVE-2024-22276)

Advisory ID: | VMSA-2024-0015 ---|--- Advisory Severity: | Moderate CVSSv3 Range: | 5.3 Synopsis: | VMware Cloud Director Object Storage Extension addresses an Insertion of Sensitive Information vulnerability CVE-2024-22276 Issue Date: | 2024-06-27 Updated On: | 2024-06-27 Initial Advisory CVEs |...

VMSA-2020-0014:VMware Tools for macOS update addresses a denial-of-service vulnerability

Advisory ID: VMSA-2020-0014 CVSSv3 Range: 3.3 Issue Date:2020-06-18 Updated On: 2020-06-18 Initial Advisory CVEs: CVE-2020-3972 Synopsis: VMware Tools for macOS update addresses a denial-of-service vulnerability CVE-2020-3972 RSS Feed Download PDF Download Text File Share this page on social medi...

VMware ESXi, Workstation and Fusion updates address multiple security issues.

a. VMware ESXi, Workstation and Fusion UHCI out-of-bounds read/write and TOCTOU vulnerabilities VMware ESXi, Workstation and Fusion contain an out-of-bounds read/write vulnerability and a Time-of-check Time-of-use TOCTOU vulnerability in the virtual USB 1.1 UHCI Universal Host Controller Interfac...

VMSA-2021-0023:VMware vRealize Orchestrator update addresses open redirect vulnerability

Advisory ID: VMSA-2021-0023.1 CVSSv3 Range: 6.5 Issue Date:2021-10-12 Updated On: 2021-10-13 CVEs: CVE-2021-22036 Synopsis: VMware vRealize Orchestrator update addresses open redirect vulnerability CVE-2021-22036 RSS Feed Download PDF Download Text File Share this page on social media: 1. Impacte...

VMware Carbon Black Cloud macOS Sensor installer updates address file overwrite issue (CVE-2020-4008)

3. VMware Carbon Black Cloud macOS Sensor installer file overwrite issue CVE-2020-4008 The installer of the macOS Sensor for VMware Carbon Black Cloud handles certain files in an insecure way. VMware has evaluated the severity of this issue to be in the Low severity range with a CVSSv3 base score...

VMSA-2020-0018:VMware ESXi, vCenter Server, and Cloud Foundation updates address a partial denial of service vulnerability

Advisory ID: VMSA-2020-0018 CVSSv3 Range: 5.3 Issue Date:2020-08-20 Updated On: 2020-08-20 Initial Advisory CVEs: CVE-2020-3976 Synopsis: VMware ESXi, vCenter Server, and Cloud Foundation updates address a partial denial of service vulnerability CVE-2020-3976 RSS Feed Download PDF Download Text...

VMware Horizon Client for Windows update addresses privilege escalation vulnerability (CVE-2020-3961)

3. VMware Horizon Client for Windows privilege escalation vulnerability VMware Horizon Client for Windows contains a privilege escalation vulnerability due to folder permission configuration and unsafe loading of libraries. VMware has evaluated the severity of this issue to be in the Important...

VMware Tools update addresses an out-of-bounds read vulnerability

VMware Tools for Windows VMware Tools Shared Folders out-of-bounds read vulnerability VMware Tools for Windows contains an out-of-bounds read vulnerability in the Shared Folders feature. Successful exploitation of this issue may lead to information disclosure or may allow attackers to escalate...

VMware Workstation, Fusion and Horizon View Client updates resolve multiple security vulnerabilities

a. Heap buffer-overflow vulnerability in VMNAT device VMware Workstation and Fusion contain a heap buffer-overflow vulnerability in VMNAT device. This issue may allow a guest to execute code on the host. VMware would like to thank Jun Mao of Tencent PC Manager working with Trend Micro's Zero Day...

VMware ESXi and ESX security update for third party library

a. Update to ESX/ESXi libxml2 userworld and service console. The ESX/ESXi userworld libxml2 library has been updated to resolve a security issue. Also, the ESX service console libxml2 packages are updated to the following versions: The Common Vulnerabilities and Exposures project cve.mitre.org ha...

ESX patches address an issue loading corrupt virtual disks and update Service Console packages

a. Loading a corrupt delta disk may cause ESX to crashIf the VMDK delta disk of a snapshot is corrupt, an ESX host might crash when the corrupted disk is loaded. VMDK delta files exist for virtual machines with one or more snapshots. This change ensures that a corrupt VMDK delta file cannot be us...

ESXi patches address partial denial of service vulnerability in hostd process (CVE-2019-5528)

3. Partial denial of service vulnerability in ESXi hostd process CVE-2019-5528 A malicious actor with network access to an ESXi host could create a partial denial of service condition in management functionality. Successful exploitation of this issue may cause hostd to become unresponsive...

VMware security updates for vCSA, vCenter Server, and ESXi

a. vCenter Server Appliance directory traversal The vCenter Server Appliance vCSA contains a directory traversal vulnerability that allows an authenticated remote user to retrieve arbitrary files. Exploitation of this issue may expose sensitive information stored on the server. VMware would like ...

VMware Workstation, Fusion and Horizon Client updates address multiple security vulnerabilities (CVE-2020-3980, CVE-2020-3986, CVE-2020-3987, CVE-2020-3988, CVE-2020-3989, CVE-2020-3990)

3a. PATH configuration privilege escalation vulnerability CVE-2020-3980 VMware Fusion contains a privilege escalation vulnerability due to the way it allows configuring the system wide path. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3...

VMware ESXi update to third party library

a. ESXi update to third party component libxml2 The libxml2 third party library has been updated which addresses multiple security issues. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the names CVE-2010-4008, CVE-2011-0216,CVE-2011-1944, CVE-2011-2834,...

ESX Service Console update for krb5

a. Service Console package krb5 updateKerberos is a network authentication protocol. It is designed toprovide strong authentication for client/server applications byusing secret-key cryptography.An input validation flaw in the asn1decodegeneraltime function inMIT Kerberos 5 before 1.6.4 allows...

VMSA-2024-0014:VMware Cloud Director addresses an improper privilege management vulnerability (CVE-2024-22272)

Advisory ID: | VMSA-2024-0014 ---|--- Advisory Severity: | Moderate CVSSv3 Range: | 4.9 Synopsis: | VMware Cloud Director addresses an Improper Privilege Management vulnerability CVE-2024-22272 Issue Date: | 2024-06-27 Updated on: | 2024-06-27 CVEs: | CVE-2024-22272 1. Impacted Products VMware...

VMware vSphere, Workstation and Fusion updates add Hypervisor-Assisted Guest Remediation for speculative execution issue

New speculative-execution control mechanism for Virtual Machines Updates of vCenter Server, ESXi, Workstation and Fusion virtualize the new speculative-execution control mechanism for Virtual Machines VMs. As a result, a patched Guest Operating System Guest OS can remediate the Branch Target...

VMware ESXi, vCenter Server, Fusion and Workstation updates resolve multiple security vulnerabilities

a. Out-of-bounds write vulnerability in SVGA VMware ESXi, Workstation and Fusion contain an out-of-bounds write vulnerability in SVGA device. This issue may allow a guest to execute code on the host. VMware would like to thank Nico Golde and Ralf-Philipp Weinmann of Comsecuris UG...

VMware product updates address information disclosure issue.

a. vCenter Server, vCloud Director, Horizon View information disclosure issue VMware products that use Flex BlazeDS may be affected by a flaw in the processing of XML External Entity XXE requests. A specially crafted XML request sent to the server could lead to unintended information be disclosed...

VMware product updates address critical information disclosure issue in JRE.

a. Oracle JRE Update Oracle JRE is updated in VMware products to address a critical security issue that existed in earlier releases of Oracle JRE. VMware products running JRE 1.7 Update 75 or newer and JRE 1.6 Update 91 or newer are not vulnerable to CVE-2014-6593, as documented in the Oracle Jav...

VMware ESX patch address security issues

a. Service Console update for sudoThe service console package sudo is updated to version 1.7.2p1-14.el58.3The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the name CVE-2012-2337 and CVE-2012-3440 to the issue addressed in this update. Column 4 of the following table lis...

VMware hosted products and ESXi/ESX patches address privilege escalation

a. VMware Tools Incorrect Folder Permissions Privilege EscalationThe access control list of the VMware Tools folder is incorrectly set. Exploitation of this issue may lead to local privilege escalation on Windows-based Guest Operating Systems.VMware would like to thank Tavis Ormandy for reporting...