Page 2 of 16 results (0.005 seconds)

CVSS: 5.0EPSS: 95%CPEs: 18EXPL: 1

CVE-2009-3733 – VMware Server 2.0.1 / ESXi Server 3.5 - Directory Traversal

https://notcve.org/view.php?id=CVE-2009-3733

Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows remote attackers to read arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en VMware Server v1.x anteriores a v1.0.10 build 203137 y v2.x anteriores a v2.0.2 build 203138 en Linux, VMware ESXi v3.5 y VMware ESX v3.0.3 y v3.5 permite a atacantes remotos leer ficheros de su elección a través de vectores de ataque sin especificar. • https://www.exploit-db.com/exploits/33310 http://lists.vmware.com/pipermail/security-announce/2009/000069.html http://secunia.com/advisories/37186 http://security.gentoo.org/glsa/glsa-201209-25.xml http://securitytracker.com/id?1023088 http://securitytracker.com/id?1023089 http://www.securityfocus.com/archive/1/507523/100/0/threaded http://www.securityfocus.com/bid/36842 http://www.vmware.com/security/advisories/VMSA-2009-0015.html http://www.vupen.com/english/advisories/2009&# • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 6.9EPSS: 0%CPEs: 34EXPL: 2

CVE-2009-2267 – VMware Virtual 8086 - Linux Local Ring0

https://notcve.org/view.php?id=CVE-2009-2267

VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, VMware ACE 2.5.x before 2.5.3 build 185404, VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138, VMware Fusion 2.x before 2.0.6 build 196839, VMware ESXi 3.5 and 4.0, and VMware ESX 2.5.5, 3.0.3, 3.5, and 4.0, when Virtual-8086 mode is used, do not properly set the exception code upon a page fault (aka #PF) exception, which allows guest OS users to gain privileges on the guest OS by specifying a crafted value for the cs register. VMware Workstation v6.5.x anteriores a v6.5.3 build 185404, VMware Player v2.5.x anteriores a v2.5.3 build 185404, VMware ACE v2.5.x anteriores a v2.5.3 build 185404, VMware Server v1.x anteriores a v1.0.10 build 203137 and v2.x anteriores a v2.0.2 build 203138, VMware Fusion v2.x anteriores a v2.0.6 build 196839, VMware ESXi v3.5 y v4.0, y VMware ESX v2.5.5, v3.0.3, v3.5 y v4.0, cuando el modo Virtual-8086 es usado, no asigna adecuadamente el código de excepción para una excepción de fallo de página (también conocido como #PF), lo que permite a usuarios del SO anfitrión obtener privilegios en el SO anfitrión especificando un valor modificado para el registro cs. • https://www.exploit-db.com/exploits/10207 http://lists.vmware.com/pipermail/security-announce/2009/000069.html http://secunia.com/advisories/37172 http://security.gentoo.org/glsa/glsa-201209-25.xml http://securitytracker.com/id?1023082 http://securitytracker.com/id?1023083 http://www.securityfocus.com/archive/1/507523/100/0/threaded http://www.securityfocus.com/archive/1/507539/100/0/threaded http://www.securityfocus.com/bid/36841 http://www.vmware.com/security/advisories/VM •

CVSS: 6.5EPSS: 0%CPEs: 38EXPL: 0

CVE-2009-2416 – mingw32-libxml2: Pointer use-after-free flaws by parsing Notation and Enumeration attribute types

https://notcve.org/view.php?id=CVE-2009-2416

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework. Múltiples vulnerabilidades de uso anterior a la liberación en libxml2 v2.5.10, v2.6.16, v2.6.26, v2.6.27, y v2.6.32, y libxml v1.8.17, permite a atacantes dependientes de contexto producir una denegación de servicio (caída de aplicación) a través de una ,manipulación de (1) una notación o (2) tipos de atributo de enumeración en un fichero XML como se demostró en Codenomicon XML fuzzing framework. • http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html http://secunia.com/advisories/35036 http://secunia.com/advisories/36207 http://secunia.com/advisories/36338 http://secunia • CWE-416: Use After Free •

CVSS: 4.0EPSS: 0%CPEs: 101EXPL: 0

CVE-2009-1805

https://notcve.org/view.php?id=CVE-2009-1805

Unspecified vulnerability in the VMware Descheduled Time Accounting driver in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, VMware Server 1.x before 1.0.9 build 156507 and 2.x before 2.0.1 build 156745, VMware Fusion 2.x before 2.0.2 build 147997, VMware ESXi 3.5, and VMware ESX 3.0.2, 3.0.3, and 3.5, when the Descheduled Time Accounting Service is not running, allows guest OS users on Windows to cause a denial of service via unknown vectors. Vulnerabilidad no especificada en el controlador VMware Descheduled Time Accounting en VMware Workstation v6.5.1 y anteriores, VMware Player v2.5.1 y anteriores, VMware ACE v2.5.1 y anteriores, VMware Server v1.x anteriores a v1.0.9 build 156507 y v2.x anteriores a v2.0.1 build 156745, VMware Fusion v2.x anteriores a v2.0.2 build 147997, VMware ESXi v3.5, y VMware ESX v3.0.2, v3.0.3, y v3.5, cuando el servicio Descheduled Time Accounting no se está ejecutando, permite a usuarios invitados del sistema operativo en Windows provocar una denegación de servicio mediante vectores desconocidos. • http://secunia.com/advisories/35269 http://www.securityfocus.com/archive/1/503912/100/0/threaded http://www.securityfocus.com/bid/35141 http://www.securitytracker.com/id?1022300 http://www.vmware.com/security/advisories/VMSA-2009-0007.html http://www.vupen.com/english/advisories/2009/1452 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6130 •

CVSS: 6.8EPSS: 0%CPEs: 93EXPL: 0

CVE-2009-1244

https://notcve.org/view.php?id=CVE-2009-1244

Unspecified vulnerability in the virtual machine display function in VMware Workstation 6.5.1 and earlier; VMware Player 2.5.1 and earlier; VMware ACE 2.5.1 and earlier; VMware Server 1.x before 1.0.9 build 156507 and 2.x before 2.0.1 build 156745; VMware Fusion before 2.0.4 build 159196; VMware ESXi 3.5; and VMware ESX 3.0.2, 3.0.3, and 3.5 allows guest OS users to execute arbitrary code on the host OS via unknown vectors, a different vulnerability than CVE-2008-4916. Una vulnerabilidad no especificada en la función de pantalla de máquina virtual de en VMware Workstation v6.5.1 y anteriores; VMware Player v2.5.1 y anteriores; VMware ACE v2.5.1 y anteriores; VMware Server v1.x antes de la v1.0.9 build 156507 y v2.x antes de v2.0.1 build 156745; VMware Fusion antes de la v2.0.4 build 159196; VMware ESXi 3.5 y VMware ESX v3.0.2, v3.0.3 y v3.5 permite ejecutar, a los usuarios invitados, código arbitrario en el sistema operativo anfitrión a través de vectores desconocidos, una vulnerabilidad diferente a la CVE-2008-4916. • http://lists.vmware.com/pipermail/security-announce/2009/000055.html http://osvdb.org/53634 http://security.gentoo.org/glsa/glsa-201209-25.xml http://www.securityfocus.com/archive/1/502615/100/0/threaded http://www.securityfocus.com/bid/34471 http://www.securitytracker.com/id?1022031 http://www.vmware.com/security/advisories/VMSA-2009-0006.html http://www.vupen.com/english/advisories/2009/0944 https://exchange.xforce.ibmcloud.com/vulnerabilities/49834 https://oval.cisecurity.org •