VMware

Pierluigi Paganini November 24, 2021
VMware addresses File Read and SSRF flaws in vCenter Server

VMware addressed arbitrary file read and server-side request forgery (SSRF) vulnerabilities in its vCenter Server product. VMware this week addressed arbitrary file read and server-side request forgery (SSRF) vulnerabilities affecting its vCenter Server product. vCenter Server is the centralized management utility for VMware, and is used to manage virtual machines, multiple ESXi hosts, and all dependent […]

Pierluigi Paganini September 25, 2021
Threat actors are attempting to exploit VMware vCenter CVE-2021-22005 flaw

Immediately after the public release of the exploit code for the VMware vCenter CVE-2021-22005 flaw threat actors started using it. Researchers warn that immediately after the release of the exploit code for the recently addressed CVE-2021-22005 flaw in VMware vCenter threat actors started using it. The CVE-2021-22005 issue is a critical arbitrary file upload vulnerability […]

Pierluigi Paganini August 26, 2021
VMware addressed 4 High-Severity flaws in vRealize Operations

VMware released security patches to address multiple vulnerabilities in vRealize Operations, including four high severity flaws. VMware addressed multiple vulnerabilities in vRealize Operations, including four high severity flaws. The most severe flaw, tracked as CVE-2021-22025 (CVSS score of 8.6), is a broken access control vulnerability in the vRealize Operations Manager API. An attacker could exploit […]

Pierluigi Paganini June 24, 2021
VMware releases patches for critical flaw in Carbon Black App Control

VMware released security patches to address an authentication bypass vulnerability in VMware Carbon Black App Control (AppC) for Windows. VMware released security patches for an authentication bypass vulnerability, tracked as CVE-2021-21998, in Carbon Black App Control (AppC) running on Windows machines. Carbon Black App Control allows to lock down critical systems and servers to prevent […]

Pierluigi Paganini June 23, 2021
VMware fixes privilege escalation issue in VMware Tools for Windows

VMware patched a high-severity vulnerability in VMware Tools for Windows that attackers could exploit to execute arbitrary code with elevated privileges. VMware patched a high-severity local privilege escalation vulnerability, tracked as CVE-2021-21999, in VMware Tools for Windows that could be exploited by attackers to execute arbitrary code with elevated privileges. The vulnerability has received a […]

Pierluigi Paganini June 04, 2021
Necro Python bot now enhanced with new VMWare, server exploits

Operators behind the Necro Python botnet have added new features to their bot, including VMWare and server exploits. Experts from Cisco Talos have recently observed a new Necro Python bot campaign and noticed that its developers have improved its capabilities. The Necro Python bot, aka FreakOut, has been in development since 2015 and early this […]

Pierluigi Paganini May 26, 2021
Another critical bug impacts all VMware vCenter Server installs

VMware addresses a critical remote code execution (RCE) flaw in the Virtual SAN Health Check plug-in that impacts all vCenter Server installs. VMware has released security updates to address a remote code execution (RCE) flaw in vCenter Server that could be exploited by attackers to execute arbitrary code on the installs. vCenter Server is the centralized […]

Pierluigi Paganini May 07, 2021
VMware addresses critical RCE in vRealize Business for Cloud

VMware has fixed a new critical RCE flaw in VMware vRealize Business for Cloud that was reported by sanctioned Russian firm Positive Technologies. VMware has addressed a critical remote code execution vulnerability, tracked as CVE-2021-21984, in VMware vRealize Business for Cloud. vRealize Business for Cloud is an automated cloud business management solution that allows customers to […]

Pierluigi Paganini April 01, 2021
VMware fixes authentication bypass in Carbon Black Cloud Workload appliance

VMware has addressed a critical authentication bypass vulnerability in the VMware Carbon Black Cloud Workload appliance. VMware has addressed a critical vulnerability, tracked as CVE-2021-21982, in the VMware Carbon Black Cloud Workload appliance that could be exploited by attackers to bypass authentication. Carbon Black Cloud Workload is a data center security product that protects customers’ workloads […]

Pierluigi Paganini April 01, 2021
VMware fixed flaws in vROps that can be chained to compromise organizations

VMware addressed two vulnerabilities in its vRealize Operations (vROps) product that can expose organizations to a significant risk of attacks The vROps delivers self-driving IT operations management for private, hybrid, and multi-cloud environments in a unified, AI-powered platform. Security researcher Egor Dimitrenko from Positive Technologies discovered a server-side request forgery (SSRF) vulnerability tracked as CVE-2021-21975 […]