CVSS: 5.6EPSS: 94%CPEs: 1467EXPL: 10CVE-2017-5753 – Multiple CPUs - 'Spectre' Information Disclosure
https://notcve.org/view.php?id=CVE-2017-5753
04 Jan 2018 — Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. Los sistemas con microprocesadores con ejecución especulativa y predicción de ramas podrían permitir la revelación no autorizada de información al atacante con acceso de usuario local mediante un análisis de un canal lateral. An industry-wide issue was found in the way many modern microprocessor designs have imp... • http://packetstormsecurity.com/files/145645/Spectre-Information-Disclosure-Proof-Of-Concept.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •
CVSS: 7.5EPSS: 0%CPEs: 27EXPL: 0CVE-2017-4928
https://notcve.org/view.php?id=CVE-2017-4928
17 Nov 2017 — An attacker may exploit these issues by sending a POST request with modified headers towards internal services leading to information disclosure. vSphere Web Client basado en flash(en versiones 6.0 anteriores a la 6.0 U3c y versiones 5.5 anteriores a la 5.5 U3f), es decir, no el nuevo vSphere Client basado en HTML5, contiene problemas de inyección SSRF y CRLF debido a una neutralización incorrecta de URL. • http://www.securityfocus.com/bid/101785 • CWE-352: Cross-Site Request Forgery (CSRF) CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0CVE-2017-4929
https://notcve.org/view.php?id=CVE-2017-4929
17 Nov 2017 — VMware NSX Edge (6.2.x before 6.2.9 and 6.3.x before 6.3.5) contains a moderate Cross-Site Scripting (XSS) issue which may lead to information disclosure. VMware NSX Edge (en versioens 6.2.x anteriores a la 6.2.9 y versiones 6.3.x anteriroes a la 6.3.5) contiene un error de Cross-Site Scripting (XSS) moderado que puede dar lugar a una revelación de información. • http://www.securityfocus.com/bid/101891 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-4922
https://notcve.org/view.php?id=CVE-2017-4922
01 Aug 2017 — VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure issue due to the service startup script using world writable directories as temporary storage for critical information. ... VMware vCenter Server en su versión 6.5 anterior a la 6.5 U1 tiene un problema de fuga de información puesto que el script de inicio del servicio utiliza directorios modificables por cualquier usuario para almacenar temporalmente información crítica. • http://www.securityfocus.com/bid/100012 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-4923
https://notcve.org/view.php?id=CVE-2017-4923
01 Aug 2017 — VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. ... VMware vCenter Server en su versión 6.5 anterior a la 6.5 U1 contiene una vulnerabilidad de fuga de información. • http://www.securityfocus.com/bid/99997 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-522: Insufficiently Protected Credentials •
CVSS: 5.5EPSS: 2%CPEs: 18EXPL: 1CVE-2017-4905 – VMware Workstation Uninitialized Memory Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2017-4905
30 Mar 2017 — VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have uninitialized memory usage. This issue may lead to an information leak. ESXi versiones 6.5 sin parche ESXi650-201703410-SG, 6.0 U3 sin parche ESXi600-201703401-SG, 6.0 U2 sin ... • https://www.exploit-db.com/exploits/47715 • CWE-908: Use of Uninitialized Resource •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2016-5334 – VMware Security Advisory 2016-0021
https://notcve.org/view.php?id=CVE-2016-5334
24 Nov 2016 — VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/META-INF files via unspecified vectors. VMware Identity Manager 2.x en versiones anteriores a 2.7.1 y vRealize Automation 7.x en versiones anteriores a 7.2.0 permite a atacantes remotos leer archivos /SAAS/WEB-INF y /SAAS/META-INF a través de vectores no especificados. VMware product updates address partial information disclosure vulnerab... • http://www.securityfocus.com/bid/94482 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 5.8EPSS: 0%CPEs: 12EXPL: 0CVE-2016-7458 – VMware Security Advisory 2016-0022
https://notcve.org/view.php?id=CVE-2016-7458
24 Nov 2016 — VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. VMware vSphere Client 5.5 en versiones anteriores a U3e y 6.0 en versiones anteriores a U2a permite a vCenter Server remoto e instancias ESXi leer archivos arbitrarios a través de un documento XML que contiene una declar... • http://www.securityfocus.com/bid/94483 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.7EPSS: 0%CPEs: 13EXPL: 0CVE-2016-7459 – VMware Security Advisory 2016-0022
https://notcve.org/view.php?id=CVE-2016-7459
24 Nov 2016 — VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch setup, or (3) Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. VMware vCenter Server 5.5 en versiones anteriores a U3e y 6.0 en versiones anteriores a U2a permite a usuarios remotos autenticados leer archivos arbitrarios a travé... • http://www.securityfocus.com/bid/94486 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 9.1EPSS: 2%CPEs: 11EXPL: 0CVE-2016-7460 – VMware Security Advisory 2016-0022
https://notcve.org/view.php?id=CVE-2016-7460
24 Nov 2016 — The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. La característica Single Sign-On en VMware vCenter Server 5.5 en versiones anteriores a U3e y 6.0 en versiones anteriores a U2a y vRealize Autom... • http://www.securityfocus.com/bid/94485 • CWE-611: Improper Restriction of XML External Entity Reference •