CVSS: 8.1EPSS: 29%CPEs: 1EXPL: 3CVE-2018-6961 – VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2018-6961
VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution. VMware NSX SD-WAN Edge by VeloCloud en versiones anteriores a la 3.1.0 contiene una vulnerabilidad de inyección de comandos en el componente local web UI. • https://www.exploit-db.com/exploits/44959 https://github.com/r3dxpl0it/CVE-2018-6961 https://github.com/bokanrb/CVE-2018-6961 http://www.securityfocus.com/bid/104185 http://www.securitytracker.com/id/1041210 http://www.vmware.com/security/advisories/VMSA-2018-0011.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2017-4920
https://notcve.org/view.php?id=CVE-2017-4920
The implementation of the OSPF protocol in VMware NSX-V Edge 6.2.x prior to 6.2.8 and NSX-V Edge 6.3.x prior to 6.3.3 doesn't correctly handle the link-state advertisement (LSA). A rogue LSA may exploit this issue resulting in continuous sending of LSAs between two routers eventually going in loop or loss of connectivity. La implementación del protocolo OSPF en VMware NSX-V Edge en versiones 6.2.x anteriores a la 6.2.8 y NSX-V Edge en versiones 6.3.x anteriores a la 6.3.3 no gestiona correctamente el LSA (link-state advertisement). Un LSA no autorizado podría explotar este problema, resultando en el envío continuo de LSA entre dos routers, lo que acabaría por provocar un bucle o la pérdida de la conectividad. • http://www.securityfocus.com/bid/100277 https://www.vmware.com/security/advisories/VMSA-2017-0014.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0CVE-2017-4929
https://notcve.org/view.php?id=CVE-2017-4929
VMware NSX Edge (6.2.x before 6.2.9 and 6.3.x before 6.3.5) contains a moderate Cross-Site Scripting (XSS) issue which may lead to information disclosure. VMware NSX Edge (en versioens 6.2.x anteriores a la 6.2.9 y versiones 6.3.x anteriroes a la 6.3.5) contiene un error de Cross-Site Scripting (XSS) moderado que puede dar lugar a una revelación de información. • http://www.securityfocus.com/bid/101891 http://www.securitytracker.com/id/1039837 https://www.vmware.com/security/advisories/VMSA-2017-0019.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 16EXPL: 0CVE-2016-2079
https://notcve.org/view.php?id=CVE-2016-2079
VMware NSX Edge 6.1 before 6.1.7 and 6.2 before 6.2.3 and vCNS Edge 5.5 before 5.5.4.3, when the SSL-VPN feature is configured, allow remote attackers to obtain sensitive information via unspecified vectors. VMware NSX Edge 6.1 en versiones anteriores a 6.1.7 y 6.2 en versiones anteriores a 6.2.3 y vCNS Edge 5.5 en versiones anteriores a 5.5.4.3, cuando la característica SSL-VPN está configurada, permiten a atacantes remotos obtener información sensible a través de vectores no especificados. • http://www.securitytracker.com/id/1036077 http://www.vmware.com/security/advisories/VMSA-2016-0007.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 17EXPL: 0CVE-2014-3796
https://notcve.org/view.php?id=CVE-2014-3796
VMware NSX 6.0 before 6.0.6, and vCloud Networking and Security (vCNS) 5.1 before 5.1.4.2 and 5.5 before 5.5.3, does not properly validate input, which allows attackers to obtain sensitive information via unspecified vectors. VMware NSX 6.0 anterior a 6.0.6, y vCloud Networking and Security (vCNS) 5.1 anterior a 5.1.4.2 y 5.5 anterior a 5.5.3, no valida debidamente las entradas, lo que permite a atacantes obtener información sensible a través de vectores no especificados. • http://secunia.com/advisories/59938 http://www.securitytracker.com/id/1030835 http://www.vmware.com/security/advisories/VMSA-2014-0009.html https://exchange.xforce.ibmcloud.com/vulnerabilities/95926 • CWE-20: Improper Input Validation •