VMware has released a security advisory (VMSA-2022-0022) addressing multiple vulnerabilities in VMware vRealize Operations. The vulnerabilities vary from an authentication bypass (CVE-2022-31675), and privilege escalation (CVE-2022-31672) to information disclosure (CVE-2022-31673, CVE-2022-316734). These vulnerabilities have been discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. VMware vRealize Operations enable self-driving IT Operations Management … Continue reading “VMware vRealize Operations Multiple Vulnerabilities Patched in the Latest Security update (CVE-2022-31672, CVE-2022-31673, CVE-2022-31674, & CVE-2022-31675)”
Tag: VMWare
VMware Patched Multiple Vulnerabilities in VMware Products including Identity Manager (vIDM) and Workspace ONE Access
VMware has released a security advisory addressing multiple vulnerabilities in important VMware products and requested the admins to update to the latest versions. The vulnerabilities varies from an authentication bypass (CVE-2022-31656), URL injection (CVE-2022-31657), path traversal (CVE-2022-31662), Cross-site scripting (XSS) (CVE-2022-31663), remote code execution (CVE-2022-31658, CVE-2022-31659, CVE-2022-31665) to privilege escalation (CVE-2022-31660, CVE-2022-31661, CVE-2022-31664). The CVSS … Continue reading “VMware Patched Multiple Vulnerabilities in VMware Products including Identity Manager (vIDM) and Workspace ONE Access”
VMware Patches Critical Vulnerabilities in VMware Identity Manager (vIDM) and Workspace ONE Access (CVE-2022-22972 & CVE-2022-22973)
VMware has released a security advisory to address two critical vulnerabilities (CVE-2022-22972 & CVE-2022-22973) impacting VMware Identity Manager (vIDM), and Workspace ONE Access. Successful exploitation of these vulnerabilities could lead to escalation of privileges and authentication bypass. CISA has also released an advisory and warned users to immediately patch these vulnerabilities. One of the two … Continue reading “VMware Patches Critical Vulnerabilities in VMware Identity Manager (vIDM) and Workspace ONE Access (CVE-2022-22972 & CVE-2022-22973)”
Multiple Vulnerabilities Patched in Popular VMware Products
On Wednesday, VMware issued a security advisory (VMSA-2022-0011) to inform customers of significant vulnerabilities in numerous products. Threat actors could exploit these vulnerabilities to carry out remote code execution attacks. VMware products impacted by these vulnerabilities include: VMware Cloud Foundation vRealize Suite Lifecycle Manager VMware Identity Manager (vIDM) VMware vRealize Automation (vRA) VMware Workspace … Continue reading “Multiple Vulnerabilities Patched in Popular VMware Products”
VMware vCenter Affected By Critical Vulnerabilities
Multiple vulnerabilities in VMware vCenter Server were privately reported to VMware. These vulnerabilities have CVSS scores ranging from 4.3 to 9.8. Out of these vulnerabilities, the most critical was CVE-2021-22005 – an arbitrary file upload vulnerability in the Analytics service, which impacts vCenter Server 6.7 and 7.0 deployments. Exploiting this vulnerability, a remote attacker could … Continue reading “VMware vCenter Affected By Critical Vulnerabilities”
VMware Multiple Vulnerabilities (VMSA-2020-0026)
On November 19, 2020, VMware published an advisory addressing critical vulnerabilities in various VMware products. VMware has evaluated the severity of CVE-2020-4004 to be “Critical” with a maximum CVSSv3 base score of 9.3. The severity of CVE-2020-4005 has been evaluated to be “Important” with a maximum CVSSv3 base score of 8.8. Affected VMware Products VMware … Continue reading “VMware Multiple Vulnerabilities (VMSA-2020-0026)”
GRUB2 Boothole Buffer Overflow Vulnerability (CVE-2020-10713)
On 29th July 2020, a team of security researchers disclosed a high priority bug in GRUB2(GRand Unified Bootloader version 2) , affecting billions of Linux and Windows systems using secure boot. CVE-2020-10713 is assigned to this buffer overflow vulnerability, termed as “Boothole”. “Boothole” Secure Boot is designed to verify all the firmware of the computer … Continue reading “GRUB2 Boothole Buffer Overflow Vulnerability (CVE-2020-10713)”
VMware Cloud Director Remote Code Execution Vulnerability
On May 19,2020 VMware released an advisory to address Remote Code Execution vulnerability in VMware Cloud Director. CVE-2020-3956 has assigned to track this vulnerability. vCloud Director VMware Cloud Director (formerly known as vCloud Director) is a popular deployment, automation, and management software that’s used to operate and manage cloud resources, allowing businesses to data centers distributed … Continue reading “VMware Cloud Director Remote Code Execution Vulnerability”
VMware vCenter Server Sensitive Information Disclosure Vulnerability
On 9th April 2020,VMware has released an advisory VMSA-2020-0006 to addressed a critical information disclosure vulnerability. CVE-2020-3952 has been assigned. Vulnerability would be exploited by attackers to compromise vCenter Server or other services that use the Directory Service (vmdir) for authentication. vCenter Server provides a centralized platform for controlling VMware vSphere environments, it helps manage … Continue reading “VMware vCenter Server Sensitive Information Disclosure Vulnerability”
Out-of-Order Execution Side-Channel attack [Spectre/Meltdown]
A flaw in Out-of-Order execution mechanism allows user level programs to leak addresses of kernel and process memory space. This vulnerability can be exploited to bypass KASLR as well as CPU security features like SMAP,SMEP,NX and PXN. It can be exploited to bypass OS process isolation. The issue affects processors from Intel, AMD ,ARM, Samsung and … Continue reading “Out-of-Order Execution Side-Channel attack [Spectre/Meltdown]”