CVSS: 9.3EPSS: 1%CPEs: 2EXPL: 0CVE-2008-4281
https://notcve.org/view.php?id=CVE-2008-4281
Directory traversal vulnerability in VMWare ESXi 3.5 before ESXe350-200810401-O-UG and ESX 3.5 before ESX350-200810201-UG allows administrators with the Datastore.FileManagement privilege to gain privileges via unknown vectors. Vulnerabilidad de salto de directorio en VMWare ESXi 3.5 anterior a ESXe350-200810401-O-UG y ESX 3.5 anterior a ESX350-200810201-UG; permite a los administradores con el privilegio Datastore.FileManagement, ganar privilegios a través de vectores desconocidos. • http://lists.vmware.com/pipermail/security-announce/2008/000042.html http://secunia.com/advisories/32624 http://www.securityfocus.com/archive/1/498138/100/0/threaded http://www.securityfocus.com/bid/32172 http://www.securitytracker.com/id?1021155 http://www.vmware.com/security/advisories/VMSA-2008-0018.html http://www.vupen.com/english/advisories/2008/3052 https://exchange.xforce.ibmcloud.com/vulnerabilities/46418 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ov • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 0CVE-2008-4279
https://notcve.org/view.php?id=CVE-2008-4279
The CPU hardware emulation for 64-bit guest operating systems in VMware Workstation 6.0.x before 6.0.5 build 109488 and 5.x before 5.5.8 build 108000; Player 2.0.x before 2.0.5 build 109488 and 1.x before 1.0.8; Server 1.x before 1.0.7 build 108231; and ESX 2.5.4 through 3.5 allows authenticated guest OS users to gain additional guest OS privileges by triggering an exception that causes the virtual CPU to perform an indirect jump to a non-canonical address. La emulación de hardware de CPU para sistemas operativos invitados de 64 bits en VMware Workstation versión 6.0.x anterior a 6.0.5 build 109488 y versión 5.x anterior a 5.5.8 build 108000; Player versión 2.0.x anterior a 2.0.5 build 109488 y versión 1.x anterior a 1.0.8; Server versión 1.x anterior a 1.0.7 build 108231; y ESX versión 2.5.4 anterior a 3.5, permite a los usuarios del sistema operativo invitado autenticado conseguir privilegios adicionales del sistema operativo invitado mediante la activación de una excepción que hace que la CPU virtual realice un salto indirecto a una dirección no canónica. • http://lists.grok.org.uk/pipermail/full-disclosure/2008-October/064860.html http://marc.info/?l=bugtraq&m=122331139823057&w=2 http://secunia.com/advisories/32157 http://secunia.com/advisories/32179 http://secunia.com/advisories/32180 http://www.securityfocus.com/archive/1/497041/100/0/threaded http://www.securityfocus.com/bid/31569 http://www.securitytracker.com/id?1020991 http://www.vmware.com/security/advisories/VMSA-2008-0016.html http://www.vupen.com/english/advisories&# • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 2.1EPSS: 0%CPEs: 4EXPL: 0CVE-2008-2101
https://notcve.org/view.php?id=CVE-2008-2101
The VMware Consolidated Backup (VCB) command-line utilities in VMware ESX 3.0.1 through 3.0.3 and ESX 3.5 place a password on the command line, which allows local users to obtain sensitive information by listing the process. La utilidad de línea de comandos VMware Consolidated Backup (VCB) de VMware ESX 3.0.1 hasta 3.0.3 y ESX 3.5 coloca una contraseña en la línea de comandos, lo cual permite a usuarios locales obtener información sensible listando el proceso. • http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html http://secunia.com/advisories/31713 http://security.gentoo.org/glsa/glsa-201209-25.xml http://securityreason.com/securityalert/4202 http://securitytracker.com/id?1020794 http://www.securityfocus.com/archive/1/495869/100/0/threaded http://www.securityfocus.com/bid/30937 http://www.vmware.com/security/advisories/VMSA-2008-0014.html http://www.vupen.com/english/advisories/2008/2466 https://exchange.xforce.i • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 26EXPL: 0CVE-2008-3281 – libxml2 denial of service
https://notcve.org/view.php?id=CVE-2008-3281
libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document. libxml2 2.6.32 y anteriores, no detecta correctamente la recursividad durante la expansión de una entidad en un valor de un atributo; esto permite a atacantes dependientes del contexto provocar una denegación de servicio (consumo de la memoria y la CPU) mediante un documento XML manipulado. • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html http://lists.vmware.com/pipermail/security-announce/2008/000039.html http://mail.gnome.org/archives/xml/2008-August/msg00034.html http://secunia.com/advisories/31558 http://secunia.com/advisories/31566 http://secunia.com/advisories/31590 http://secunia.com/advisories/3172 • CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') •
CVSS: 7.2EPSS: 0%CPEs: 17EXPL: 0CVE-2008-2100
https://notcve.org/view.php?id=CVE-2008-2100
Multiple buffer overflows in VIX API 1.1.x before 1.1.4 build 93057 on VMware Workstation 5.x and 6.x, VMware Player 1.x and 2.x, VMware ACE 2.x, VMware Server 1.x, VMware Fusion 1.x, VMware ESXi 3.5, and VMware ESX 3.0.1 through 3.5 allow guest OS users to execute arbitrary code on the host OS via unspecified vectors. Múltiples desbordamientos de buffer en VIX API 1.1.x anteriores a 1.1.4 build 93057 en VMware Workstation 5.x y 6.x, VMware Player 1.x y 2.x, VMware ACE 2.x, VMware Server 1.x, VMware Fusion 1.x, VMware ESXi 3.5, y VMware ESX 3.0.1 hasta la 3.5, permite a los usuarios del sistema huésped, ejecutar código arbitrario en el sistema anfitrión a través de vectores no específicos. • http://secunia.com/advisories/30556 http://security.gentoo.org/glsa/glsa-201209-25.xml http://securityreason.com/securityalert/3922 http://securitytracker.com/id?1020200 http://www.securityfocus.com/archive/1/493080/100/0/threaded http://www.securityfocus.com/bid/29552 http://www.vmware.com/security/advisories/VMSA-2008-0009.html http://www.vupen.com/english/advisories/2008/1744 https://exchange.xforce.ibmcloud.com/vulnerabilities/42872 https://oval.cisecurity.org/repository/search/de • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •