CVSS: 7.6EPSS: 0%CPEs: 6EXPL: 0CVE-2016-2076 – VMware Security Advisory 2016-0004
https://notcve.org/view.php?id=CVE-2016-2076
15 Apr 2016 — Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, which allows remote attackers to hijack sessions via a crafted web site. Client Integration Plugin (CIP) en VMware vCenter Server 5.5 U3a, U3b y U3c y 6.0 en versiones anteriores a U2; vCloud Director 5.5.5; y vRealize Automation Identity Appliance 6.2.4 en versiones anteriores a 6.2.4.1 no maneja ... • http://www.securitytracker.com/id/1035570 • CWE-287: Improper Authentication •
CVSS: 10.0EPSS: 89%CPEs: 345EXPL: 23CVE-2014-7169 – GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-7169
25 Sep 2014 — GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a ... • https://packetstorm.news/files/id/128650 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-228: Improper Handling of Syntactically Invalid Structure •
CVSS: 10.0EPSS: 94%CPEs: 345EXPL: 135CVE-2014-6271 – GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-6271
24 Sep 2014 — GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." N... • https://packetstorm.news/files/id/181111 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 0CVE-2013-5971 – VMware Security Advisory 2013-0012
https://notcve.org/view.php?id=CVE-2013-5971
18 Oct 2013 — Session fixation vulnerability in the vSphere Web Client Server in VMware vCenter Server 5.0 before Update 3 allows remote attackers to hijack web sessions and gain privileges via unspecified vectors. Vulnerabilidad de fijación de sesión en el vSphere Web Client Server de VMware vCenter Server 5.0 anterior a Update 3 permite a atacantes remotos secuestrar sesiones web y obtener privilegios a través de vectores sin especificar. VMware has updated vCenter Server, vCenter Server Appliance (vCSA), vSphere Updat... • http://osvdb.org/98718 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.1EPSS: 1%CPEs: 32EXPL: 0CVE-2013-1659
https://notcve.org/view.php?id=CVE-2013-1659
22 Feb 2013 — VMware vCenter Server 4.0 before Update 4b, 5.0 before Update 2, and 5.1 before 5.1.0b; VMware ESXi 3.5 through 5.1; and VMware ESX 3.5 through 4.1 do not properly implement the Network File Copy (NFC) protocol, which allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption) by modifying the client-server data stream. VMware vCenter Server v4.0 anterior a Update 4b, v5.0 anterior a Update 2, y v5.1 anterior a 5.1.0b; VMware ESXi v3.5 a la v5.1; y VMware ES... • http://www.vmware.com/security/advisories/VMSA-2013-0003.html •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2012-6326
https://notcve.org/view.php?id=CVE-2012-6326
22 Feb 2013 — VMware vCenter Server 4.1 before Update 3 and 5.0 before Update 2, and vCSA 5.0 before Update 2, allows remote attackers to cause a denial of service (disk consumption) via vectors that trigger large log entries. VMware vCenter Server v4.1 anterio a Update 3 and v5.0 anterior a Update 2, y vCSA v5.0 anterior a Update 2, permite a atacantes remotos causar una denegación de servicio (consumo de disco) mediante vectores que generan largas entradas en el log. • http://www.vmware.com/security/advisories/VMSA-2012-0018.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 0%CPEs: 20EXPL: 0CVE-2013-1405
https://notcve.org/view.php?id=CVE-2013-1405
15 Feb 2013 — VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware VI-Client 2.5, VMware ESXi 3.5 through 4.1, and VMware ESX 3.5 through 4.1 do not properly implement the management authentication protocol, which allow remote servers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. VMware vCenter Server v4.0 anteriormente Update v4b y v4.1 anteriormente ... • http://www.vmware.com/security/advisories/VMSA-2013-0001.html • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2010-2928
https://notcve.org/view.php?id=CVE-2010-2928
16 Feb 2011 — The vCenter Tomcat Management Application in VMware vCenter Server 4.1 before Update 1 stores log-on credentials in a configuration file, which allows local users to gain privileges by reading this file. La aplicación vCenter Tomcat Management en VMware vCenter Server v4.1 anterior a Update 1, almacena credenciales de inicio de sesión en un archivo de configuración, que permite a usuarios locales obtener privilegios mediante la lectura de este archivo. • http://osvdb.org/70859 • CWE-255: Credentials Management Errors •