CVSS: 6.8EPSS: 0%CPEs: 120EXPL: 0CVE-2019-5516
https://notcve.org/view.php?id=CVE-2019-5516
VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before 10.1.6) updates address an out-of-bounds vulnerability with the vertex shader functionality. Exploitation of this issue requires an attacker to have access to a virtual machine with 3D graphics enabled. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to create a denial-of-service condition on their own VM. The workaround for this issue involves disabling the 3D-acceleration feature. This feature is not enabled by default on ESXi and is enabled by default on Workstation and Fusion. • https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0762 https://www.vmware.com/security/advisories/VMSA-2019-0006.html • CWE-125: Out-of-bounds Read •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2019-3795 – Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security
https://notcve.org/view.php?id=CVE-2019-3795
Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection. Las versiones 4.2.x de Spring Security anteriores a 4.2.12, 5.0.x anteriores a 5.0.12 y 5.1.x anteriores a 5.1.5 contienen una vulnerabilidad de aleatoriedad insegura cuando se utiliza SecureRandomFactoryBean#setSeed para configurar una petición de SecureRandom. Para ser impactado, una aplicación honesta debe proporcionar una semilla y poner el material aleatorio resultante a disposición de un atacante para su inspección. • http://www.securityfocus.com/bid/107802 https://lists.debian.org/debian-lts-announce/2019/05/msg00026.html https://pivotal.io/security/cve-2019-3795 • CWE-330: Use of Insufficiently Random Values •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2019-5515 – VMware Workstation e1000 Memory Corruption Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2019-5515
VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) and Fusion (11.x before 11.0.3, 10.x before 10.1.6) updates address an out-of-bounds write vulnerability in the e1000 and e1000e virtual network adapters. Exploitation of this issue may lead to code execution on the host from the guest but it is more likely to result in a denial of service of the guest. Las actualizaciones de VMware Workstation (en las versiones 15.x anteriores a a la 15.0.3, y las 14.x anteriores a la 14.1.6) y de Fusion (en las versiones 11.x anteriores a a la 11.0.3, y las 10.x anteriores a la 10.1.6) abordan una vulnerabilidad de escritura fuera de límites en los adaptadores de red virtual e1000 y e1000e. La explotación de este problema podría conducir a una ejecución de código en el host desde el invitado, pero es más probable que resulte en una denegación de servicio (DoS) de esta.. This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of VMware Workstation. • https://packetstormsecurity.com/files/152290/VMware-Security-Advisory-2019-0005.html https://www.securityfocus.com/bid/107634 https://www.vmware.com/security/advisories/VMSA-2019-0005.html https://www.zerodayinitiative.com/advisories/ZDI-19-306 https://www.zerodayinitiative.com/advisories/ZDI-19-516 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 75EXPL: 0CVE-2019-5519 – VMware Workstation UHCI Race Condition Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2019-5519
VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14.x before 14.1.7), Fusion (11.x before 11.0.3, 10.x before 10.1.6) contain a Time-of-check Time-of-use (TOCTOU) vulnerability in the virtual USB 1.1 UHCI (Universal Host Controller Interface). Exploitation of this issue requires an attacker to have access to a virtual machine with a virtual USB controller present. This issue may allow a guest to execute code on the host. VMware ESXi (en las versiones 6.7 anteriores a la ESXi670-201903001, en las 6.5 anteriores a la ESXi650-201903001 y en las 6.0 anteriores a la ESXi600-201903001), Workstation (en las versiones 15.x anteriores a la 15.0.4 y en las 14.x anteriores a la 14.1.7), Fusion (en las versiones 11.x anteriores a la 11.0.3 y en las 10.x anteriores a la 10.1.6) contiene una vulnerabilidad de time-of-check time-of-use (TOCTOU) en la UHCI virtual (Universal Host Controller Interface) de USB 1.1. La explotación de este fallo requiere que el atacante tenga acceso a una máquina virtual con un controlador USB virtual presente. • http://packetstormsecurity.com/files/152290/VMware-Security-Advisory-2019-0005.html http://www.securityfocus.com/bid/107535 http://www.securityfocus.com/bid/108443 https://www.vmware.com/security/advisories/VMSA-2019-0005.html https://www.zerodayinitiative.com/advisories/ZDI-19-420 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2019-5524
https://notcve.org/view.php?id=CVE-2019-5524
VMware Workstation (14.x before 14.1.6) and Fusion (10.x before 10.1.6) contain an out-of-bounds write vulnerability in the e1000 virtual network adapter. This issue may allow a guest to execute code on the host. VMware Workstation (en las versiones 14.x anteriores a la 14.1.6) y Fusion (en las versiones 10.x anteriores a la 10.1.6) contienen una vulnerabilidad de escritura fuera de límites en el adaptador de red virtual e1000. Este problema puede permitir que un invitado ejecute código en el host. • http://packetstormsecurity.com/files/152290/VMware-Security-Advisory-2019-0005.html http://www.securityfocus.com/bid/107635 https://www.vmware.com/security/advisories/VMSA-2019-0005.html • CWE-787: Out-of-bounds Write •