Page 6 of 70 results (0.014 seconds)

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-4921

https://notcve.org/view.php?id=CVE-2017-4921

01 Aug 2017 — VMware vCenter Server (6.5 prior to 6.5 U1) contains an insecure library loading issue that occurs due to the use of LD_LIBRARY_PATH variable in an unsafe manner. Successful exploitation of this issue may allow unprivileged host users to load a shared library that may lead to privilege escalation. VMware vCenter Server en su versión 6.5 anterior a la 6.5 U1 tiene un problema de carga insegura de librerías que ocurre porque se utiliza la variable LD_LIBRARY_PATH de una manera no segura. Si se explota con éxi... • http://www.securityfocus.com/bid/100006 •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-4923

https://notcve.org/view.php?id=CVE-2017-4923

01 Aug 2017 — VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when using the vCenter Server Appliance file-based backup feature. VMware vCenter Server en su versión 6.5 anterior a la 6.5 U1 contiene una vulnerabilidad de fuga de información. Esta vulnerabilidad permite que se obtengan credenciales en texto plano cuando se utiliza la función de copia de seguridad de archivos de vCenter Server Appliance. • http://www.securityfocus.com/bid/99997 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-522: Insufficiently Protected Credentials •

CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0

CVE-2017-4919

https://notcve.org/view.php?id=CVE-2017-4919

28 Jul 2017 — VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to authenticate. VMware vCenter Server versiones 5.5, 6.0, 6.5, permite a los usuarios de vSphere con ciertos privilegios de vSphere limitados usar la API VIX para acceder a los Sistemas Operativos Invitados sin la necesidad de autenticarse. • http://www.securityfocus.com/bid/100102 • CWE-306: Missing Authentication for Critical Function •

CVSS: 7.7EPSS: 0%CPEs: 13EXPL: 0

CVE-2016-7459 – VMware Security Advisory 2016-0022

https://notcve.org/view.php?id=CVE-2016-7459

24 Nov 2016 — VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch setup, or (3) Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. VMware vCenter Server 5.5 en versiones anteriores a U3e y 6.0 en versiones anteriores a U2a permite a usuarios remotos autenticados leer archivos arbitrarios a través de un docume... • http://www.securityfocus.com/bid/94486 • CWE-611: Improper Restriction of XML External Entity Reference •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1

CVE-2016-5331 – VMware vSphere Hypervisor (ESXi) HTTP Response Injection

https://notcve.org/view.php?id=CVE-2016-5331

05 Aug 2016 — CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Vulnerabilidad de inyección CRLF en VMware vCenter Server 6.0 en versiones anteriores a U2 y ESXi 6.0 permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y llevar a cabo ataques de separación de respuestas HTTP a través de vectores no especificados. The SySS GmbH found out that the web server... • https://packetstorm.news/files/id/138211 • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') •

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0

CVE-2015-6931 – VMware Security Advisory 2016-0009

https://notcve.org/view.php?id=CVE-2015-6931

15 Jun 2016 — Cross-site scripting (XSS) vulnerability in the vSphere Web Client in VMware vCenter Server 5.0 before U3g, 5.1 before U3d, and 5.5 before U2d allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en el vSphere Web Client in VMware vCenter Server 5.0 en versiones anteriores a U3g, 5.1 en versiones anteriores a U3d y 5.5 en versiones anteriores a U2d permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipul... • http://www.securitytracker.com/id/1036112 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 2

CVE-2016-2078 – VMWare vSphere Web Client 6.0 Cross Site Scripting

https://notcve.org/view.php?id=CVE-2016-2078

25 May 2016 — Cross-site scripting (XSS) vulnerability in the Web Client in VMware vCenter Server 5.1 before update 3d, 5.5 before update 3d, and 6.0 before update 2 on Windows allows remote attackers to inject arbitrary web script or HTML via the flashvars parameter. Vulnerabilidad de XSS en el Web Client de VMware vCenter Server 5.1 en versiones anteriores a la actualización 3d, 5.5 en versiones anteriores a la actualización 3d y 6.0 en versiones anteriores a la actualización 2 en Windows permite a atacantes remotos in... • https://packetstorm.news/files/id/137189 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.6EPSS: 0%CPEs: 6EXPL: 0

CVE-2016-2076 – VMware Security Advisory 2016-0004

https://notcve.org/view.php?id=CVE-2016-2076

15 Apr 2016 — Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, which allows remote attackers to hijack sessions via a crafted web site. Client Integration Plugin (CIP) en VMware vCenter Server 5.5 U3a, U3b y U3c y 6.0 en versiones anteriores a U2; vCloud Director 5.5.5; y vRealize Automation Identity Appliance 6.2.4 en versiones anteriores a 6.2.4.1 no maneja ... • http://www.securitytracker.com/id/1035570 • CWE-287: Improper Authentication •

CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0

CVE-2015-1047

https://notcve.org/view.php?id=CVE-2015-1047

12 Oct 2015 — vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message. vpxd en Vmware vCenter Server 5.0 en versiones anteriores a u3e, 5.1 en versiones anteriores a u3 y 5.5 en versiones anteriores a u2 permite a atacantes remotos provocar una denegación de servicio a través de un mensaje heartbeat largo. • http://www.securityfocus.com/bid/76932 • CWE-20: Improper Input Validation •

CVSS: 10.0EPSS: 97%CPEs: 4EXPL: 1

CVE-2015-2342 – VMware vCenter Server JMX RMI Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2015-2342

02 Oct 2015 — The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol. El servicio JMX RMI en Vmware vCenter Server 5.0 en versiones anteriores a u3e, 5.1 en versiones anteriores a u3b, 5.5 en versiones anteriores a u3 y 6.0 en versiones anterioes a u1 no restringe el registro de Mbeans, lo que permite a atacantes remotos ejecutar código arbitrario a ... • https://www.exploit-db.com/exploits/36101 •