CVSS: 7.7EPSS: 0%CPEs: 13EXPL: 0CVE-2016-7459 – VMware Security Advisory 2016-0022
https://notcve.org/view.php?id=CVE-2016-7459
24 Nov 2016 — VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch setup, or (3) Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. VMware vCenter Server 5.5 en versiones anteriores a U3e y 6.0 en versiones anteriores a U2a permite a usuarios remotos autenticados leer archivos arbitrarios a través de un docume... • http://www.securityfocus.com/bid/94486 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2016-5331 – VMware vSphere Hypervisor (ESXi) HTTP Response Injection
https://notcve.org/view.php?id=CVE-2016-5331
05 Aug 2016 — CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Vulnerabilidad de inyección CRLF en VMware vCenter Server 6.0 en versiones anteriores a U2 y ESXi 6.0 permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y llevar a cabo ataques de separación de respuestas HTTP a través de vectores no especificados. The SySS GmbH found out that the web server... • https://packetstorm.news/files/id/138211 • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 2CVE-2016-2078 – VMWare vSphere Web Client 6.0 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2016-2078
25 May 2016 — Cross-site scripting (XSS) vulnerability in the Web Client in VMware vCenter Server 5.1 before update 3d, 5.5 before update 3d, and 6.0 before update 2 on Windows allows remote attackers to inject arbitrary web script or HTML via the flashvars parameter. Vulnerabilidad de XSS en el Web Client de VMware vCenter Server 5.1 en versiones anteriores a la actualización 3d, 5.5 en versiones anteriores a la actualización 3d y 6.0 en versiones anteriores a la actualización 2 en Windows permite a atacantes remotos in... • https://packetstorm.news/files/id/137189 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.6EPSS: 0%CPEs: 6EXPL: 0CVE-2016-2076 – VMware Security Advisory 2016-0004
https://notcve.org/view.php?id=CVE-2016-2076
15 Apr 2016 — Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, which allows remote attackers to hijack sessions via a crafted web site. Client Integration Plugin (CIP) en VMware vCenter Server 5.5 U3a, U3b y U3c y 6.0 en versiones anteriores a U2; vCloud Director 5.5.5; y vRealize Automation Identity Appliance 6.2.4 en versiones anteriores a 6.2.4.1 no maneja ... • http://www.securitytracker.com/id/1035570 • CWE-287: Improper Authentication •
CVSS: 10.0EPSS: 92%CPEs: 4EXPL: 1CVE-2015-2342 – VMware vCenter Server JMX RMI Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-2342
02 Oct 2015 — The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol. El servicio JMX RMI en Vmware vCenter Server 5.0 en versiones anteriores a u3e, 5.1 en versiones anteriores a u3b, 5.5 en versiones anteriores a u3 y 6.0 en versiones anterioes a u1 no restringe el registro de Mbeans, lo que permite a atacantes remotos ejecutar código arbitrario a ... • https://www.exploit-db.com/exploits/36101 •
CVSS: 5.9EPSS: 0%CPEs: 12EXPL: 0CVE-2015-6932
https://notcve.org/view.php?id=CVE-2015-6932
18 Sep 2015 — VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Vulnerabilidad en VMware vCenter Server 5.5 en versiones anteriores a u3 y 6.0 en versiones anteriores a u1, no verifica los certificados X.509 de los servidores TLS LDAP, lo que permite a atacantes man-in-the-middle suplantar servidores y obtener información sensible a través de u... • http://www.securitytracker.com/id/1033582 • CWE-310: Cryptographic Issues •