CVSS: 5.9EPSS: 0%CPEs: 29EXPL: 0CVE-2019-5537
https://notcve.org/view.php?id=CVE-2019-5537
28 Oct 2019 — Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server Appliance (6.7 before 6.7u3a and 6.5 before 6.5u3d) may allow a malicious actor to intercept sensitive data in transit over FTPS and HTTPS. A malicious actor with man-in-the-middle positioning between vCenter Server Appliance and a backup target may be able to intercept sensitive data in transit during File-Based Backup and Restore operat... • https://www.vmware.com/security/advisories/VMSA-2019-0018.html • CWE-295: Improper Certificate Validation •
CVSS: 5.8EPSS: 0%CPEs: 68EXPL: 0CVE-2019-5531 – VMware Security Advisory 2019-0013
https://notcve.org/view.php?id=CVE-2019-5531
18 Sep 2019 — VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a websocket connection to a user’s browser may be able to obtain control of a VM Console after the user has logged out or th... • http://www.vmware.com/security/advisories/VMSA-2019-0013.html • CWE-613: Insufficient Session Expiration •
CVSS: 7.7EPSS: 1%CPEs: 44EXPL: 0CVE-2019-5532 – VMware Security Advisory 2019-0013
https://notcve.org/view.php?id=CVE-2019-5532
18 Sep 2019 — VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability due to the logging of credentials in plain-text for virtual machines deployed through OVF. A malicious user with access to the log files containing vCenter OVF-properties of a virtual machine deployed from an OVF may be able to view the credentials used to deploy the OVF (typically the root account of the virtual machine). VMware vCenter Server (versión 6.7.x anterior ... • http://packetstormsecurity.com/files/154536/VMware-Security-Advisory-2019-0013.html • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.7EPSS: 0%CPEs: 44EXPL: 0CVE-2019-5534 – VMware Security Advisory 2019-0013
https://notcve.org/view.php?id=CVE-2019-5534
18 Sep 2019 — VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability where Virtual Machines deployed from an OVF could expose login information via the virtual machine's vAppConfig properties. A malicious actor with access to query the vAppConfig properties of a virtual machine deployed from an OVF may be able to view the credentials used to deploy the OVF (typically the root account of the virtual machine). VMware vCenter Server (versi... • http://packetstormsecurity.com/files/154536/VMware-Security-Advisory-2019-0013.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-522: Insufficiently Protected Credentials •