CVE-2014-6271

CVE-2014-6271 (Shellshock) affects GNU Bash up to 4.3, enabling remote code execution by processing trailing strings after function definitions in environment variables. Exploitation vectors include OpenSSH ForceCommand, mod_cgi/mod_cgid in Apache, DHCP client scripts, and other environment-passi...

CVE-2014-7169

CVE-2014-7169 affects GNU Bash up to 4.3, where parsing of function definitions in environment variables can be exploited to run commands or impact other attributes across privilege boundaries (notably via ForceCommand in OpenSSH sshd and via mod_cgi/mod_cgid in Apache, as well as DHCP client scr...

CVE-2014-4258

CVE-2014-4258 affects the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier, enabling remote authenticated users to impact confidentiality, integrity, and availability via SRINFOSC. Contained in multiple advisories; mitigations include upgrading MariaDB/Mysql-relate...

CVE-2013-3107

CVE-2013-3107 affects VMware vCenter Server 5.1 (including 5.1a/5.1b) when Active Directory anonymous LDAP binding is enabled. Remote attackers can bypass authentication by supplying a valid username with an empty password. Root cause: improper handling of login credentials under AD anonymous bin...

CVE-2014-4241

CVE-2014-4241 affects Oracle WebLogic Server within Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0. The initial entry describes an unspecified vulnerability that allows remote attackers to affect integrity via vectors related to WLS - Web Services. Connected documents provide context for WebLogic...

CVE-2013-1659

CVE-2013-1659 affects VMware vCenter Server and ESXi/ESX products, where improper implementation of the Network File Copy (NFC) protocol enables a man‑in‑the‑middle to modify the client–server data stream, potentially causing memory corruption or arbitrary code execution. Affected: VMware vCenter...

CVE-2014-8371

CVE-2014-8371 affects VMware vCenter Server and vCSA when connecting to an ESXi CIM server; root cause is improper certificate validation that enables MITM spoofing of CIM services. Affected versions: vCSA 5.5 before Update 2, vCenter Server 5.1 before Update 3, and 5.0 before Update 3c. Remediat...

CVE-2012-6324

CVE-2012-6324 is a directory traversal vulnerability in VMware vCenter Server Appliance (vCSA) affecting vCSA 5.0 before Update 2 and 5.1 before Patch 1. An authenticated remote user can read arbitrary files via unspecified vectors. The advisory VMSA-2012-0018 confirms the issue and its remediati...

CVE-2014-3797

CVE-2014-3797 is an XSS vulnerability in VMware vCenter Server Appliance (vCSA) 5.1 prior to Update 3, allowing remote attackers to inject arbitrary script/HTML via unspecified vectors. Connected sources confirm the issue and that remediation is available: vCSA 5.1 Update 3 (and related patches i...

CVE-2013-3079

VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 contains a remote authenticated code execution vulnerability in the Virtual Appliance Management Interface (VAMI). An authenticated attacker with VAMI access can run arbitrary programs with root privileges. The issue is addressed by VMwar...

CVE-2012-6325

CVE-2012-6325 affects VMware vCenter Server Appliance (vCSA) 5.0 prior to Update 2, due to an XML parsing vulnerability that allows an authenticated remote user to read arbitrary files. The issue is documented in the VMware advisory VMSA-2012-0018 and is addressed by upgrading to vCSA 5.0 Update ...

CVE-2012-6326

CVE-2012-6326 affects VMware vCenter Server 4.1 before Update 3 and 5.0 before Update 2, and vCenter Server Appliance/vCSA 5.0 before Update 2, enabling unauthenticated remote users to trigger abnormally large log entries and cause a denial of service (disk consumption). Connected advisories conf...

CVE-2013-3080

Summary (CVE-2013-3080) : VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 contains a vulnerability in the Virtual Appliance Management Interface (VAMI). An authenticated remote attacker can upload files to an arbitrary location via VAMI, potentially overwriting files and enabling code ...

CVE-2014-3790

The CVE-2014-3790 entry concerns VMware vCenter Server Appliance's Ruby vSphere Console (RVC). The vulnerability arises from escaping the chroot jail, enabling remote authenticated users to execute arbitrary commands as root. Documents consistently describe a privilege-escalation path via RVC tha...