Page 2 of 15 results (0.018 seconds)

CVSS: 4.0EPSS: 0%CPEs: 2EXPL: 0

CVE-2012-1513

https://notcve.org/view.php?id=CVE-2012-1513

The Web Configuration tool in VMware vCenter Orchestrator (vCO) 4.0 before Update 4, 4.1 before Update 2, and 4.2 before Update 1 places the vCenter Server password in an HTML document, which allows remote authenticated administrators to obtain sensitive information by reading this document. La herramienta "Web Configuration" en VMWare vCenter Orchestrator (vCO) v4.0 anterior a Update v4, v4.1 anterior a Update v2, y v4.2 anterior a Update v1 situa la contraseña vCenter Server en un documento HTML, lo que permite a administradores remotos autenticados obtener información delicada mediante la lectura de este fichero. • http://osvdb.org/80120 http://secunia.com/advisories/48408 http://www.securityfocus.com/bid/52525 http://www.securitytracker.com/id?1026816 http://www.vmware.com/security/advisories/VMSA-2012-0005.html https://exchange.xforce.ibmcloud.com/vulnerabilities/74091 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 5.0EPSS: 96%CPEs: 6EXPL: 1

CVE-2011-4404 – VMware - Update Manager Directory Traversal

https://notcve.org/view.php?id=CVE-2011-4404

The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to CVE-2009-1523. La configuración por defecto del servidor HTTP en Jetty en vSphere Update Manager bajo VMware vCenter Update Manager v4.0 antes de la actualización 4 y v4.1 antes de la actualización 2 permite realizar ataques de salto de directorio y leer archivos arbitrarios a atacantes remotos a través de vectores no especificados. Se trata de un problema relacionado con CVE-2009 -1523. VMware Update Manager versions 4.1 prior to update 2 suffer from a directory traversal vulnerability. • https://www.exploit-db.com/exploits/18138 http://jetty.codehaus.org/jetty/jetty-6/xref/org/mortbay/jetty/handler/ResourceHandler.html http://jetty.codehaus.org/jetty/jetty-6/xref/org/mortbay/jetty/servlet/DefaultServlet.html http://www.securitytracker.com/id?1026341 http://www.vmware.com/security/advisories/VMSA-2011-0014.html https://www.vmware.com/security/advisories/VMSA-2011-0014.html http://dsecrg.com/pages/vul/show.php?id=342 • CWE-16: Configuration •

CVSS: 2.1EPSS: 0%CPEs: 4EXPL: 0

CVE-2011-1788

https://notcve.org/view.php?id=CVE-2011-1788

vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1 allows local users to discover the SOAP session ID via unspecified vectors. vCenter Server en VMware vCenter v4.0 anterior a la actualización 3 y v4.1 anterior a la actualización 1 permite a los usuarios locales descubrir el ID de las sesiones SOAP mediante vectores no especificados. • http://lists.vmware.com/pipermail/security-announce/2011/000137.html http://osvdb.org/72179 http://securitytracker.com/id?1025502 http://www.securityfocus.com/bid/47742 http://www.vmware.com/security/advisories/VMSA-2011-0008.html https://exchange.xforce.ibmcloud.com/vulnerabilities/67304 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0

CVE-2011-0426

https://notcve.org/view.php?id=CVE-2011-0426

Directory traversal vulnerability in vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, and VMware VirtualCenter 2.5 before Update 6a, allows remote attackers to read arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en vCenter Server en VMware vCenter v4.0 anterior a Update 3 y v4.1 anterior a Update v1, y VMware VirtualCenter v2.5 anterior a Update 6a, permite a atacantes remotos leer archivos de su elección a través de vectores no especificados. • http://lists.vmware.com/pipermail/security-announce/2011/000137.html http://securitytracker.com/id?1025502 http://www.vmware.com/security/advisories/VMSA-2011-0008.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 5.0EPSS: 0%CPEs: 8EXPL: 0

CVE-2011-1789

https://notcve.org/view.php?id=CVE-2011-1789

The self-extracting installer in the vSphere Client Installer package in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, VMware ESXi 4.x before 4.1 Update 1, and VMware ESX 4.x before 4.1 Update 1 does not have a digital signature, which might make it easier for remote attackers to spoof the software distribution via a Trojan horse installer. El instalador auto-extraible del cliente vSphere en VMware vCenter 4.0 anteriores a la Actualización 3 y v4.1 anteriores a la Actualización 1, VMware ESXi v4.x anteriores a v4.1 Actualización 1, y VMware ESX v4.x anteriores a v4.1 Actualización 1 no tiene una firma digital , lo que podría facilitar a los atacantes remotos a falsificar la distribución de software a través de un instalador troyanizado. • http://lists.vmware.com/pipermail/security-announce/2011/000137.html http://securitytracker.com/id?1025502 http://www.vmware.com/security/advisories/VMSA-2011-0008.html • CWE-310: Cryptographic Issues •