CVSS: 7.7EPSS: 0%CPEs: 44EXPL: 0CVE-2019-5534 – VMware Security Advisory 2019-0013
https://notcve.org/view.php?id=CVE-2019-5534
18 Sep 2019 — VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability where Virtual Machines deployed from an OVF could expose login information via the virtual machine's vAppConfig properties. A malicious actor with access to query the vAppConfig properties of a virtual machine deployed from an OVF may be able to view the credentials used to deploy the OVF (typically the root account of the virtual machine). VMware vCenter Server (versi... • http://packetstormsecurity.com/files/154536/VMware-Security-Advisory-2019-0013.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-522: Insufficiently Protected Credentials •
CVSS: 7.5EPSS: 0%CPEs: 27EXPL: 0CVE-2017-4928
https://notcve.org/view.php?id=CVE-2017-4928
17 Nov 2017 — The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers towards internal services leading to information disclosure. vSphere Web Client basado en flash(en versiones 6.0 anteriores a la 6.0 U3c y versiones 5.5 anteriores a la 5.5 U3f), es decir, no el nuevo vSphere Client bas... • http://www.securityfocus.com/bid/101785 • CWE-352: Cross-Site Request Forgery (CSRF) CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-4927
https://notcve.org/view.php?id=CVE-2017-4927
17 Nov 2017 — VMware vCenter Server (6.5 prior to 6.5 U1 and 6.0 prior to 6.0 U3c) does not correctly handle specially crafted LDAP network packets which may allow for remote denial of service. VMware vCenter Server (en versiones 6.5 anteriores a la 6.5 U1 y versiones 6.0 anteriores a la 6.0 U3c) no gestiona correctamente paquetes de red LDAP especialmente manipulados, lo que puede permitir que se provoque una denegación de servicio de forma remota. • http://www.securityfocus.com/bid/101786 • CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2017-4919
https://notcve.org/view.php?id=CVE-2017-4919
28 Jul 2017 — VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to authenticate. VMware vCenter Server versiones 5.5, 6.0, 6.5, permite a los usuarios de vSphere con ciertos privilegios de vSphere limitados usar la API VIX para acceder a los Sistemas Operativos Invitados sin la necesidad de autenticarse. • http://www.securityfocus.com/bid/100102 • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.7EPSS: 0%CPEs: 13EXPL: 0CVE-2016-7459 – VMware Security Advisory 2016-0022
https://notcve.org/view.php?id=CVE-2016-7459
24 Nov 2016 — VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch setup, or (3) Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. VMware vCenter Server 5.5 en versiones anteriores a U3e y 6.0 en versiones anteriores a U2a permite a usuarios remotos autenticados leer archivos arbitrarios a través de un docume... • http://www.securityfocus.com/bid/94486 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2016-5331 – VMware vSphere Hypervisor (ESXi) HTTP Response Injection
https://notcve.org/view.php?id=CVE-2016-5331
05 Aug 2016 — CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Vulnerabilidad de inyección CRLF en VMware vCenter Server 6.0 en versiones anteriores a U2 y ESXi 6.0 permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y llevar a cabo ataques de separación de respuestas HTTP a través de vectores no especificados. The SySS GmbH found out that the web server... • https://packetstorm.news/files/id/138211 • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2015-6931 – VMware Security Advisory 2016-0009
https://notcve.org/view.php?id=CVE-2015-6931
15 Jun 2016 — Cross-site scripting (XSS) vulnerability in the vSphere Web Client in VMware vCenter Server 5.0 before U3g, 5.1 before U3d, and 5.5 before U2d allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en el vSphere Web Client in VMware vCenter Server 5.0 en versiones anteriores a U3g, 5.1 en versiones anteriores a U3d y 5.5 en versiones anteriores a U2d permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipul... • http://www.securitytracker.com/id/1036112 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 2CVE-2016-2078 – VMWare vSphere Web Client 6.0 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2016-2078
25 May 2016 — Cross-site scripting (XSS) vulnerability in the Web Client in VMware vCenter Server 5.1 before update 3d, 5.5 before update 3d, and 6.0 before update 2 on Windows allows remote attackers to inject arbitrary web script or HTML via the flashvars parameter. Vulnerabilidad de XSS en el Web Client de VMware vCenter Server 5.1 en versiones anteriores a la actualización 3d, 5.5 en versiones anteriores a la actualización 3d y 6.0 en versiones anteriores a la actualización 2 en Windows permite a atacantes remotos in... • https://packetstorm.news/files/id/137189 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.6EPSS: 0%CPEs: 6EXPL: 0CVE-2016-2076 – VMware Security Advisory 2016-0004
https://notcve.org/view.php?id=CVE-2016-2076
15 Apr 2016 — Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, which allows remote attackers to hijack sessions via a crafted web site. Client Integration Plugin (CIP) en VMware vCenter Server 5.5 U3a, U3b y U3c y 6.0 en versiones anteriores a U2; vCloud Director 5.5.5; y vRealize Automation Identity Appliance 6.2.4 en versiones anteriores a 6.2.4.1 no maneja ... • http://www.securitytracker.com/id/1035570 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2015-1047
https://notcve.org/view.php?id=CVE-2015-1047
12 Oct 2015 — vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message. vpxd en Vmware vCenter Server 5.0 en versiones anteriores a u3e, 5.1 en versiones anteriores a u3 y 5.5 en versiones anteriores a u2 permite a atacantes remotos provocar una denegación de servicio a través de un mensaje heartbeat largo. • http://www.securityfocus.com/bid/76932 • CWE-20: Improper Input Validation •