CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-3977
https://notcve.org/view.php?id=CVE-2020-3977
22 Sep 2020 — VMware Horizon DaaS (7.x and 8.x before 8.0.1 Update 1) contains a broken authentication vulnerability due to a flaw in the way it handled the first factor authentication. Successful exploitation of this issue may allow an attacker to bypass two-factor authentication process. In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS. VMware Horizon DaaS (versiones 7.x y versiones 8.x anteriores a 8.0.1 Update 1), contiene una vulnerabilidad de autenticación rota debido a un ... • https://www.vmware.com/security/advisories/VMSA-2020-0021.html • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 87%CPEs: 260EXPL: 2CVE-2019-5544 – VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2019-5544
06 Dec 2019 — OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. OpenSLP, como es usado en ESXi y los dispositivos Horizon DaaS, presenta un problema de sobrescritura de la pila. VMware ha evaluado la gravedad de este problema para estar en el rango de gravedad Crítica con una puntuación base máxima CVSSv3 de 9.8. A heap overflow vulnerability was found in OpenSLP.... • https://github.com/HynekPetrak/CVE-2019-5544_CVE-2020-3992 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 4%CPEs: 1EXPL: 0CVE-2018-6960 – VMware Security Advisory 2018-0010
https://notcve.org/view.php?id=CVE-2018-6960
20 Apr 2018 — VMware Horizon DaaS (7.x before 8.0.0) contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authentication. Note: In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS. VMware Horizon DaaS (versiones 7.x anteriores a la 8.0.0) contiene una vulnerabilidad de autenticación rota que podría permitir que un atacante omita la autenticación de doble factor. Nota: para explotar este problema, un atacante debe tener una cuenta legítima en... • http://www.securityfocus.com/bid/103938 • CWE-287: Improper Authentication •