Page 14 of 70 results (0.005 seconds)

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0

CVE-2014-4632

https://notcve.org/view.php?id=CVE-2014-4632

VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 and the proxy client in EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x do not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoof servers, and bypass intended backup and restore access restrictions, via a crafted certificate. vSphere Data Protection (VDP) versión 5.1, versiones 5.5 anteriores a 5.5.9 y versiones 5.8 anteriores a 5.8.1 de VMware y el cliente proxy en Avamar Data Store (ADS) y Avamar Virtual Edition (AVE) versiones 6.x y 7.0.x de EMC, no comprueba apropiadamente los certificados X.509 de los servidores SSL de vCenter Server, lo que permite atacantes de tipo man-in-the-middle falsificar servidores, y omitir las restricciones de acceso de copia de seguridad y restauración previstas, por medio de un certificado diseñado. • http://archives.neohapsis.com/archives/bugtraq/2015-01/0154.html http://www.securitytracker.com/id/1031664 http://www.vmware.com/security/advisories/VMSA-2015-0002.html https://exchange.xforce.ibmcloud.com/vulnerabilities/100866 • CWE-310: Cryptographic Issues •

CVSS: 9.3EPSS: 1%CPEs: 4EXPL: 0

CVE-2014-1209

https://notcve.org/view.php?id=CVE-2014-1209

VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers to trigger the downloading and execution of an arbitrary program via unspecified vectors. VMware vSphere Client 4.0, 4.1, 5.0 anterior a Update 3 y 5.1 anterior a Update 2 no valida debidamente actualizaciones a archivos de clientes, lo que permite a atacantes remotos provocar la descarga y ejecución de un programa arbitrario a través de vectores no especificados. • http://www.vmware.com/security/advisories/VMSA-2014-0003.html • CWE-20: Improper Input Validation •

CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2014-1210

https://notcve.org/view.php?id=CVE-2014-1210

VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate. VMware vSphere Client 5.0 anterior a Update 3 y 5.1 anterior a Update 2 no valida debidamente certificados X.509, lo que permite a atacantes man-in-the-middle falsificar servidores SSL a través de un certificado manipulado. • http://www.vmware.com/security/advisories/VMSA-2014-0003.html • CWE-310: Cryptographic Issues •

CVSS: 10.0EPSS: 0%CPEs: 20EXPL: 0

CVE-2013-1405

https://notcve.org/view.php?id=CVE-2013-1405

VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware VI-Client 2.5, VMware ESXi 3.5 through 4.1, and VMware ESX 3.5 through 4.1 do not properly implement the management authentication protocol, which allow remote servers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. VMware vCenter Server v4.0 anteriormente Update v4b y v4.1 anteriormente Update v3a, VMware VirtualCenter v2.5, VMware vSphere Client v4.0 anteriormente Update v4b y 4.1 anteriormente Update v3a, VMware VI-Client v2.5, VMware ESXi v3.5 hasta v4.1, y VMware ESX v3.5 hasta v4.1 no implementa correctamente el protocolo de gestión de autentificación, el cual permite a servidores remotos ejecutar código o causar una denegación de servicios en la memoria corrupta por vectores sin especificar. • http://www.vmware.com/security/advisories/VMSA-2013-0001.html • CWE-287: Improper Authentication •

CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0

CVE-2012-1512

https://notcve.org/view.php?id=CVE-2012-1512

Cross-site scripting (XSS) vulnerability in the internal browser in vSphere Client in VMware vSphere 4.1 before Update 2 and 5.0 before Update 1 allows remote attackers to inject arbitrary web script or HTML via a crafted log-file entry. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el navegador interno en vSphere Client en VMWare vSphere v4.1 anterior a Update v2 y v5.0 anterior a Update v1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de una entrada log-file manipulada. • http://osvdb.org/80119 http://secunia.com/advisories/48387 http://www.securityfocus.com/bid/52525 http://www.securitytracker.com/id?1026817 http://www.vmware.com/security/advisories/VMSA-2012-0005.html https://exchange.xforce.ibmcloud.com/vulnerabilities/74093 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •