CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-31693
https://notcve.org/view.php?id=CVE-2022-31693
VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges in the Windows guest OS, where VMware Tools is installed, can trigger a PANIC in the VM3DMP driver leading to a denial-of-service condition in the Windows guest OS. • https://security.netapp.com/advisory/ntap-20221223-0009 https://security.netapp.com/advisory/ntap-20230824-0009 https://www.vmware.com/security/advisories/VMSA-2022-0029.html •
CVSS: 6.7EPSS: 0%CPEs: 1EXPL: 0CVE-2009-1142
https://notcve.org/view.php?id=CVE-2009-1142
An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can gain privileges via a symlink attack on /tmp files if vmware-user-suid-wrapper is setuid root and the ChmodChownDirectory function is enabled. Se descubrió un problema en open-vm-tools 2009.03.18-154848. Los usuarios locales pueden obtener privilegios mediante un ataque de symlink en archivos /tmp si vmware-user-suid-wrapper tiene setuid root y la función ChmodChownDirectory está habilitada. • https://bugs.gentoo.org/264577 https://github.com/vmware/open-vm-tools/releases/tag/2009.03.18-154848 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.0EPSS: 0%CPEs: 1EXPL: 0CVE-2009-1143
https://notcve.org/view.php?id=CVE-2009-1143
An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can bypass intended access restrictions on mounting shares via a symlink attack that leverages a realpath race condition in mount.vmhgfs (aka hgfsmounter). Se descubrió un problema en open-vm-tools 2009.03.18-154848. Los usuarios locales pueden hacer una omisión sobre las restricciones de acceso previstas para el montaje de recursos compartidos mediante un ataque de symlink que aprovecha una condición ejecución de realpath en mount.vmhgfs (también conocido como hgfsmounter). • https://bugs.gentoo.org/264577 https://github.com/vmware/open-vm-tools/releases/tag/2009.03.18-154848 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 1CVE-2022-31691
https://notcve.org/view.php?id=CVE-2022-31691
Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certain circumstances allows for potentially harmful remote code execution by the attacker. Spring Tools 4 para Eclipse versión 4.16.0 y siguientes, así como extensiones VSCode como Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor y Cloudfoundry Manifest YML Support versión 1.39.0 y siguientes utilizan la librería Snakeyaml para admitir la edición YAML. Esta librería permite una sintaxis especial en YAML que, en determinadas circunstancias, permite que el atacante ejecute código remoto potencialmente dañino. • https://github.com/SpindleSec/CVE-2022-31691 https://tanzu.vmware.com/security/cve-2022-31691 •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2022-31676 – open-vm-tools: local root privilege escalation in the virtual machine
https://notcve.org/view.php?id=CVE-2022-31676
VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine. VMware Tools (versiones 12.0.0, 11.x.y y 10.x.y) contiene una vulnerabilidad de escalada de privilegios local. Un actor malicioso con acceso local no administrativo al Sistema Operativo invitado puede escalar privilegios como usuario root en la máquina virtual. A flaw was found in open-vm-tools. • http://www.openwall.com/lists/oss-security/2022/08/23/3 https://lists.debian.org/debian-lts-announce/2022/08/msg00013.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C5VV2R4LV4T3SNQJYRLFD4C75HBDVV76 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O4TZF6QRJIDECGMEGBPXJCHZ6YC3VZ6Z https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZA63DWRW7HROTVBNRIPBJQWBYIYAQMEW https://security.gentoo.org/glsa/202 • CWE-250: Execution with Unnecessary Privileges CWE-269: Improper Privilege Management •