CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6967
https://notcve.org/view.php?id=CVE-2018-6967
VMware ESXi (6.7 before ESXi670-201806401-BG), Workstation (14.x before 14.1.2), and Fusion (10.x before 10.1.2) contain an out-of-bounds read vulnerability in the shader translator. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to crash their VMs, a different vulnerability than CVE-2018-6965 and CVE-2018-6966. VMware ESXi (versiones 6.7 anteriores a ESXi670-201806401-BG), Workstation (versiones 14.x anteriores a la 14.1.2) y Fusion (versiones 10.x anteriores a la 10.1.2) contienen una vulnerabilidad de lectura fuera de límites en el traductor del shader. • http://www.securityfocus.com/bid/104709 http://www.securitytracker.com/id/1041208 https://www.vmware.com/security/advisories/VMSA-2018-0016.html • CWE-125: Out-of-bounds Read •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6965
https://notcve.org/view.php?id=CVE-2018-6965
VMware ESXi (6.7 before ESXi670-201806401-BG), Workstation (14.x before 14.1.2), and Fusion (10.x before 10.1.2) contain an out-of-bounds read vulnerability in the shader translator. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to crash their VMs, a different vulnerability than CVE-2018-6966 and CVE-2018-6967. VMware ESXi (versiones 6.7 anteriores a ESXi670-201806401-BG), Workstation (versiones 14.x anteriores a la 14.1.2) y Fusion (versiones 10.x, anteriores a la 10.1.2) contienen una vulnerabilidad de lectura fuera de límites en el traductor del shader. • http://www.securityfocus.com/bid/104709 http://www.securitytracker.com/id/1041208 https://www.vmware.com/security/advisories/VMSA-2018-0016.html • CWE-125: Out-of-bounds Read •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6966
https://notcve.org/view.php?id=CVE-2018-6966
VMware ESXi (6.7 before ESXi670-201806401-BG), Workstation (14.x before 14.1.2), and Fusion (10.x before 10.1.2) contain an out-of-bounds read vulnerability in the shader translator. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to crash their VMs, a different vulnerability than CVE-2018-6965 and CVE-2018-6967. VMware ESXi (versiones 6.7, anteriores a ESXi670-201806401-BG), Workstation (versiones 14.x, anteriores a la 14.1.2) y Fusion (versiones 10.x, anteriores a la 10.1.2) contienen una vulnerabilidad de lectura fuera de límites en el traductor del shader. • http://www.securityfocus.com/bid/104709 http://www.securitytracker.com/id/1041208 https://www.vmware.com/security/advisories/VMSA-2018-0016.html • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 0CVE-2017-4952
https://notcve.org/view.php?id=CVE-2017-4952
VMware Xenon 1.x, prior to 1.5.4-CR7_1, 1.5.7_7, 1.5.4-CR6_2, 1.3.7-CR1_2, 1.1.0-CR0-3, 1.1.0-CR3_1,1.4.2-CR4_1, and 1.5.4_8, contains an authentication bypass vulnerability due to insufficient access controls for utility endpoints. Successful exploitation of this issue may result in information disclosure. VMware Xenon en versiones 1.x anteriores a la 1.5.4-CR7_1, 1.5.7_7, 1.5.4-CR6_2, 1.3.7-CR1_2, 1.1.0-CR0-3, 1.1.0-CR3_1,1.4.2-CR4_1 y 1.5.4_8, contiene una vulnerabilidad de omisión de autenticación debido a los controles de acceso insuficiente para los endpoints de la utilidad. • http://seclists.org/oss-sec/2018/q1/153 http://www.securityfocus.com/bid/103093 https://github.com/vmware/xenon/commit/055ae13603f0cc3cd7cf59f20ce314bf8db583e1 https://github.com/vmware/xenon/commit/06b9947cf603ba40fd8b03bfeb2e84528a7ab592 https://github.com/vmware/xenon/commit/30ae41bccf418d88b52b35a81efb3c1304b798f8 https://github.com/vmware/xenon/commit/5682ef8d40569afd00fb9a5933e7706bb5b66713 https://github.com/vmware/xenon/commit/756d893573414eec8635c2aba2345c4dcf10b21c https://github.com/vmware/xenon/commit/7a747d82b • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.6EPSS: 97%CPEs: 1467EXPL: 3CVE-2017-5753 – Multiple CPUs - 'Spectre' Information Disclosure
https://notcve.org/view.php?id=CVE-2017-5753
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. Los sistemas con microprocesadores con ejecución especulativa y predicción de ramas podrían permitir la revelación no autorizada de información al atacante con acceso de usuario local mediante un análisis de un canal lateral. An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited. Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. • https://www.exploit-db.com/exploits/43427 https://github.com/sachinthaBS/Spectre-Vulnerability-CVE-2017-5753- http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.html http://nvidia.custhe • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •