VMSA-2024-0010: VMware Workstation and Fusion updates address multiple security vulnerabilities (CVE-2024-22267, CVE-2024-22268, CVE-2024-22269, CVE-2024-22270)

Advisory ID: | VMSA-2024-0010 ---|--- Advisory Severity: | Critical CVSSv3 Range: | 7.1-9.3 Synopsis: | VMware Workstation and Fusion updates address multiple security vulnerabilities CVE-2024-22267, CVE-2024-22268, CVE-2024-22269, CVE-2024-22270 Issue date: | 2024-05-14 Updated on: | 2024-05-14...

VMSA-2021-0025:VMware vCenter Server updates address a privilege escalation vulnerability

Advisory ID: VMSA-2021-0025.6 CVSSv3 Range: 7.1 Issue Date:2021-11-10 Updated On: 2022-12-15 CVEs: CVE-2021-22048 Synopsis: VMware vCenter Server updates address a privilege escalation vulnerability CVE-2021-22048 RSS Feed Download PDF Download Text File Share this page on social media: 1...

VMware Workspace ONE UEM console patches address a denial of service vulnerability (CVE-2021-22029)

3. Advisory Details VMware Workspace ONE UEM REST API contains a denial of service vulnerability. VMware has evaluated this issue to be of 'Moderate' severity with a maximum CVSSv3 base score of 5.3...

VMSA-2015-0006:VMware vCenter Server updates address a LDAP certificate validation issue

VMSA-2015-0006.1 VMware vCenter Server updates address a LDAP certificate validation issue VMware Security Advisory VMware Security AdvisoryAdvisory ID: VMSA-2015-0006.1 VMware Security AdvisorySynopsis: VMware vCenter Server updates address a LDAP certificate validation issue VMware Security...

VMSA-2013-0011:VMware ESXi and ESX address an NFC Protocol Unhandled Exception

VMSA-2013-0011 VMware ESXi and ESX address an NFC Protocol Unhandled Exception VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2013-0011 VMware Security Advisory Synopsis: VMware ESXi and ESX address an NFC Protocol Unhandled Exception VMware Security Advisory Issue date:...

VMSA-2013-0005:VMware vFabric Postgres security updates

VMSA-2013-0005 VMware vFabric Postgres security updates VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2013-0005 VMware Security Advisory Synopsis: VMware vFabric Postgres security updates VMware Security Advisory Issue date: 2013-04-04 VMware Security Advisory Updated on:...

VMware ESXi and ESX updates to third party libraries and ESX Service Console

a. ESX third party update for Service Console kernelThis update takes the console OS kernel package to kernel-2.6.18-238.9.1 which resolves multiple security issues.The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the names CVE-2010-1083, CVE-2010-2492, CVE-2010-2798,...

VMware vCenter Orchestrator and Alive Enterprise remote code execution vulnerability

a. Vulnerability in third party Apache Struts componentVMware vCenter Orchestrator is an application to automate management tasks. Alive Enterprise is an application to monitor processes. Both products embed Apache Struts which is a third party component.The following vulnerability has been...

VMware ESX third party updates for Service Console packages glibc, sudo, and openldap

a. Service Console update for glibcThe service console packages glibc, glibc-common, and nscd are each updated to version 2.5-34.4908.vmw. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the names CVE-2010-3847 and CVE-2010-3856 to the issues addressed in this update...

ESXi utilities and ESX Service Console third party updates

a. Service Console update for COS kernel Updated COS package "kernel" addresses the security issues that are fixed through versions 2.6.18-164.11.1. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the names CVE-2009-2695, CVE-2009-2908, CVE-2009-3228, CVE-2009-3286,...

ESX Service Console and vMA updates for nss and nspr

a. Update for Service Console packages nss and nspr Service console packages for Network Security Services NSS and NetScape Portable Runtime NSPR are updated to versions nss-3.12.3.99.3-1.2157 and nspr-4.7.6-1.2213 respectively. This patch fixes several security issues in the service console...

VMSA-2008-0015:Updated ESXi and ESX 3.5 packages address CRITICAL security issue in openwsman

VMSA-2008-0015 Updated ESXi and ESX 3.5 packages address critical security issue in openwsman VMware Security Advisory VMware Security AdvisoryAdvisory ID: VMSA-2008-0015 VMware Security AdvisorySynopsis: Updated ESXi and ESX 3.5 packages address critical security issue in openwsman VMware Securi...

VMware vRealize Orchestrator update addresses open redirect vulnerability (CVE-2021-22036)

3. VMware vRealize Orchestrator update addresses open redirect vulnerability CVE-2021-22036 VMware vRealize Orchestrator contains an open redirect vulnerability due to improper path handling. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv...

VMSA-2019-0006:VMware ESXi, Workstation and Fusion updates address multiple out-of-bounds read vulnerabilities

VMSA-2019-0006 VMware ESXi, Workstation and Fusion updates address multiple out-of-bounds read vulnerabilities. VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2019-0006 VMware Security Advisory Severity: Important VMware Security Advisory Synopsis: VMware ESXi, Workstation an...

VMSA-2016-0006:VMware vCenter Server updates address an HIGH cross-site scripting issue

VMSA-2016-0006 VMware vCenter Server updates address an important cross-site scripting issue. VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2016-0006 VMware Security Advisory Synopsis: VMware vCenter Server updates address an important cross-site scripting issue VMware...

VMware vCenter and ESXi updates address critical security issues.

a. VMware ESXi OpenSLP Remote Code Execution VMware ESXi contains a double free flaw in OpenSLP's SLPDProcessMessage function. Exploitation of this issue may allow an unauthenticated attacker to remotely execute code on the ESXi host. VMware would like to thank Qinghao Tang of QIHU 360 for...

VMSA-2011-0005:VMware vCenter Orchestrator and Alive Enterprise remote code execution vulnerability

VMSA-2011-0005.3 VMware vCenter Orchestrator and Alive Enterprise remote code execution vulnerability VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2011-0005.3 VMware Security Advisory Synopsis: VMware vCenter Orchestrator and Alive Enterprise remote code execution...

VMSA-2011-0001:VMware ESX third party updates for Service Console packages glibc, sudo, and openldap

VMSA-2011-0001.3 VMware ESX third party updates for Service Console packages glibc, sudo, and openldap VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2011-0001.3 VMware Security Advisory Synopsis: VMware ESX third party updates for Service Console packages glibc, sudo, and...

VMSA-2023-0005:VMware vRealize Orchestrator update addresses an XML External Entity (XXE) vulnerability

Advisory ID: VMSA-2023-0005 CVSSv3 Range: 8.8 Issue Date:2023-02-21 Updated On: 2023-02-21 Initial Advisory CVEs: CVE-2023-20855 Synopsis: VMware vRealize Orchestrator update addresses an XML External Entity XXE vulnerability CVE-2023-20855 RSS Feed Download PDF Download Text File Share this page...

Operating System-Specific Mitigations address L1 Terminal Fault - OS vulnerability in VMware Virtual Appliances.

VMware Virtual Appliance Mitigations address L1 Terminal Fault - OS vulnerability. Successful exploitation of this issue may lead to local information disclosure of sensitive information. Unaffected products lines are documented in KB55807. The Common Vulnerabilities and Exposures project...

VMware hosted product updates, ESX patches and VI Client update resolve multiple security issue

a. VMware vmkernel third party e1000e Driver Packet Filter Bypass There is an issue in the e1000e Linux driver for Intel PRO/1000 adapters that allows a remote attacker to bypass packet filters. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the name CVE-2009-4536 to...

VMSA-2010-0003:VMSA-2010-0003.1 ESX Service Console update for net-snmp

VMSA-2010-0003.1 VMSA-2010-0003.1 ESX Service Console update for net-snmp VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2010-0003.1 VMware Security Advisory Synopsis: VMSA-2010-0003.1 ESX Service Console update for net-snmp VMware Security Advisory Issue date: 2010-02-16...

VMSA-2009-0003:ESX 2.5.5 patch 12 updates service console packag ed

VMSA-2009-0003 ESX 2.5.5 patch 12 updates service console packag ed VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2009-0003 VMware Security Advisory Synopsis: ESX 2.5.5 patch 12 updates service console packag ed VMware Security Advisory Issue date: 2009-01-26 VMware Security...

VMSA-2009-0001:ESX patches address an issue loading corrupt virtual disks and update Service Console packages

VMSA-2009-0001.1 ESX patches address an issue loading corrupt virtual disks and update Service Console packages VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2009-0001.1 VMware Security Advisory Synopsis: ESX patches address an issue loading corrupt virtual disks and update...

Updated Tomcat and Java JRE packages for VirtualCenter 2.5, VirtualCenter 2.0.2, ESX 3.5, ESX 3.0.2, and ESX 3.0.1.

Updated ESX and VirtualCenter fixes the following application vulnerabilities...

VMSA-2023-0020:VMware Aria Operations updates address local privilege escalation vulnerability.

Advisory ID: VMSA-2023-0020 CVSSv3 Range: 6.7 Issue Date:2023-09-26 Updated On: 2023-09-26 Initial Advisory CVEs: CVE-2023-34043 Synopsis: VMware Aria Operations updates address local privilege escalation vulnerability. CVE-2023-34043 RSS Feed Download PDF Download Text File Share this page on...

VMSA-2022-0019:VMware vRealize Log Insight contains multiple stored cross-site scripting vulnerabilities

Advisory ID: VMSA-2022-0019 CVSSv3 Range: 3.9 Issue Date:2022-07-12 Updated On: 2022-07-12 Initial Advisory CVEs: CVE-2022-31654, CVE-2022-31655 Synopsis: VMware vRealize Log Insight contains multiple stored cross-site scripting vulnerabilities RSS Feed Download PDF Download Text File Share this...

VMware ESXi, Workstation, Fusion, VMware Remote Console and Horizon Client updates address multiple security vulnerabilities (CVE-2020-3957, CVE-2020-3958, CVE-2020-3959)

3a. Service opener - Time-of-check Time-of-use TOCTOU issue CVE-2020-3957 VMware Fusion, VMRC for Mac and Horizon Client for Mac contain a local privilege escalation vulnerability due to a Time-of-check Time-of-use TOCTOU issue in the service opener. VMware has evaluated the severity of this issu...

VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability (CVE-2020-3940)

3. VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability CVE-2020-3940 VMware Workspace ONE SDK and dependent mobile applications do not properly handle certificate verification failures if SSL Pinning has been enabled in the...

VMSA-2013-0010:VMware Workstation host privilege escalation vulnerability

VMSA-2013-0010 VMware Workstation host privilege escalation vulnerability VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2013-0010 VMware Security Advisory Synopsis: VMware Workstation host privilege escalation vulnerability VMware Security Advisory Issue date: 2013-08-22...

VMware View privilege escalation and cross-site scripting

a. VMware Virtual Desktop Display Driver Privilege EscalationThe VMware XPDM and WDDM display drivers contain buffer overflow vulnerabilities and the XPDM display driver does not properly check for NULL pointers. Exploitation of these issues may lead to local privilege escalation on View virtual...

Updated ESX packages for OpenSSL, net-snmp, perl

I Security Issuesa. OpenSSL Binaries UpdatedThis fix updates the third party OpenSSL library.The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the names CVE-2007-3108 and CVE-2007-5135 to the issues addressed by this update...

VMSA-2022-0031:VMware vRealize Network Insight (vRNI) updates address command injection and directory traversal security vulnerabilities

Advisory ID: VMSA-2022-0031 CVSSv3 Range: 7.5-9.8 Issue Date:2022-12-13 Updated On: 2022-12-13 Initial Advisory CVEs: CVE-2022-31702, CVE-2022-31703 Synopsis: VMware vRealize Network Insight vRNI updates address command injection and directory traversal security vulnerabilities CVE-2022-31702,...

VMSA-2022-0027:VMware Cloud Foundation updates address multiple vulnerabilities

Advisory ID: VMSA-2022-0027.2 CVSSv3 Range: 5.3-9.8 Issue Date:2022-10-25 Updated On: 2023-03-09 CVEs: CVE-2021-39144, CVE-2022-31678 Synopsis: VMware Cloud Foundation updates address multiple vulnerabilities. RSS Feed Download PDF Download Text File Share this page on social media: 1. Impacted...

VMSA-2013-0001:VMware vSphere security updates for the authentication service and third party libraries

VMSA-2013-0001.5 VMware vSphere security updates for the authentication service and third party libraries VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2013-0001.5 VMware Security Advisory Synopsis: VMware vSphere security updates for the authentication service and third par...

VMSA-2011-0010:VMware ESX third party updates for Service Console packages glibc and dhcp

VMSA-2011-0010.3 VMware ESX third party updates for Service Console packages glibc and dhcp VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2011-0010.3 VMware Security Advisory Synopsis: VMware ESX third party updates for Service Console packages glibc and dhcp VMware Security...

VMSA-2010-0005:VMware products address vulnerabilities in WebAccess

VMSA-2010-0005 VMware products address vulnerabilities in WebAccess VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2010-0005 VMware Security Advisory Synopsis: VMware products address vulnerabilities in WebAccess VMware Security Advisory Issue date: 2010-03-29 VMware Security...

Updated ESXi and ESX 3.5 packages address critical security issue in openwsman

a. Updated Openwsman Openwsman is a system management platform that implements the Web Services Management protocol WS-Management. It is installed and running by default. It is used in the VMware Management Service Console and in ESXi. The openwsman 2.0.0 management service on ESX 3.5 and ESXi 3....

Updated ESX service console packages for Samba and vmnix

I Service Console rpm updates a. Security Update to Service Console Kernel This fix upgrades service console kernel version to 2.4.21-57.EL. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the names CVE-2007-5001, CVE-2007-6151, CVE-2007-6206, CVE-2008-0007,...

VMSA-2024-0004:VMware Aria Operations updates address local privilege escalation vulnerability (CVE-2024-22235)

Advisory ID: | VMSA-2024-0004 ---|--- Advisory Severity: | Moderate CVSSv3 Range: | 6.7 Synopsis: | VMware Aria Operations updates address local privilege escalation vulnerability. CVE-2024-22235 Issue date: | 2024-02-20 Updated on: | 2024-02-20 Initial Advisory CVEs | CVE-2024-22235 1. Impacted...

VMSA-2023-0010:NSX-T update addresses cross-site scripting vulnerability

Advisory ID: VMSA-2023-0010 CVSSv3 Range: 4.3 Issue Date:2023-05-23 Updated On: 2023-05-23 Initial Advisory CVEs: CVE-2023-20868 Synopsis: NSX-T update addresses cross-site scripting vulnerability CVE-2023-20868 RSS Feed Download PDF Download Text File Share this page on social media: 1. Impacted...

VMSA-2022-0032:VMware Workspace ONE Access and Identity Manager updates address multiple vulnerabilities

Advisory ID: VMSA-2022-0032 CVSSv3 Range: 5.3-7.2 Issue Date:2022-12-13 Updated On: 2022-12-13 Initial Advisory CVEs: CVE-2022-31700, CVE-2022-31701 Synopsis: VMware Workspace ONE Access and Identity Manager updates address multiple vulnerabilities CVE-2022-31700, CVE-2022-31701. RSS Feed Downloa...

VMware ESXi, Workstation and Fusion updates address use-after-free and privilege escalation vulnerabilities (CVE-2020-4004, CVE-2020-4005)

3a. Use-after-free vulnerability in XHCI USB controller CVE-2020-4004 VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9....

VMSA-2020-0003:vRealize Operations for Horizon Adapter updates address multiple security vulnerabilities

Advisory ID: VMSA-2020-0003 CVSSv3 Range: 5.3-9.0 Issue Date:2020-02-18 Updated On: 2020-02-18 Initial Advisory CVEs: CVE-2020-3943, CVE-2020-3944, CVE-2020-3945 Synopsis: vRealize Operations for Horizon Adapter updates address multiple security vulnerabilities CVE-2020-3943, CVE-2020-3944,...

VMware vCenter Server, ESXi, Workstation, Player, and Fusion updates address security issues

a. VMware ESXi, Workstation, Player, and Fusion host privilege escalation vulnerability VMware ESXi, Workstation, Player and Fusion contain an arbitrary file write issue. Exploitation this issue may allow for privilege escalation on the host. The vulnerability does not allow for privilege...

VMware security updates for vCenter Server

a. vCenter Server AD anonymous LDAP binding credential by-passvCenter Server when deployed in an environment that uses Active Directory AD with anonymous LDAP binding enabled doesn't properly handle login credentials. In this environment, authenticating to vCenter Server with a valid user name an...

VMware vSphere security updates for the authentication service and third party libraries

a. VMware vSphere client-side authentication memory corruption vulnerabilityVMware vCenter Server, vSphere Client, and ESX contain a vulnerability in the handling of the management authentication protocol. To exploit this vulnerability, an attacker must convince either vCenter Server, vSphere...

VMSA-2010-0011:VMware Studio 2.1 addresses security vulnerabilities in virtual appliances created with Studio 2.0.

VMSA-2010-0011 VMware Studio 2.1 addresses security vulnerabilities in virtual appliances created with Studio 2.0. VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2010-0011 VMware Security Advisory Synopsis: VMware Studio 2.1 addresses security vulnerabilities in virtual...

VMware View 3.1.3 addresses an important cross-site scripting vulnerability

VMware View 3.1.3 addresses an cross-site scripting vulnerability in VMware View. In order for an attacker to exploit the vulnerability, the attacker would need to lure the user to click on the attacker's URL. VMware would like to thank Alexey Sintsov from Digital Security Research Group DSecRG f...

VMSA-2025-0008: VMware Aria automation updates address a DOM based Cross-site scripting vulnerability (CVE-2025-22249)

Advisory ID: | VMSA-2025-0008 ---|--- Advisory Severity: | Important CVSSv3 Range: | 8.2 Synopsis: | VMware Aria automation updates address a DOM based Cross-site scripting vulnerability CVE-2025-22249 Issue date: | 2025-05-12 Updated on: | 2025-05-12 CVEs | CVE-2025-22249 1. Impacted Products...