Page 2 - Sphere Client News Today

Affects vCenter Server versions 6.5, 6.7 and 7.0.

The company warns that ransomware gangs are primed to exploit two flaws to conduct remote code execution attacks

VMware Urges Rapid Patching for Serious vCenter Server Bug Compliance Compliance Twitter Get Permission VMware is warning all vCenter Server administrators to patch their software to fix both a serious vulnerability that could be used to execute arbitrary code, as well as a separate authentication flaw. Administrators use vCenter Server to manage installations of vSphere, which is VMwares virtualization platform. The vulnerabilities need "your immediate attention if you are using vCenter Serv...

Critical RCE Vulnerability Discovered in VMware vCenter Server May 26, 2021 11:32 GMT   ·  Comment      VMware VMware has released fixes to address a significant vulnerability in vCenter System that can be exploited by an attacker to execute arbitrary code on the server.   The vulnerability, identified as CVE-2021-21985 (CVSS score 9.8), originates from a lack of input validation in the Virtual SAN (vSAN) plug-in Health Check. This plug-in is enabled by default in vCenter Server...

The vulnerabilities were discovered by Mikhail Klyuchnikov, senior web application security researcher at Positive Technologies. "There is already scanning of the internet for this vulnerability," he told DCK. When Positive Technologies released its report on the vulnerability Wednesday, the research firm was able to find more than 6,000 VMware vCenter devices worldwide that were accessible via the internet and had this vulnerability, a quarter of them located in the US. While exposed systems a...

By Juha Saarinen on Feb 25, 2021 11:27AM Patches available for no-authentication vulnerability with proof-of-concept. Administrators are advised to patch their VMware servers as soon as possible, after a proof of concept for a critical remote code execution (RCE) vulnerability that requires no authentication to exploit was released. Positive Technologies security researcher Mikhail Klyuchnikov reported the RCE vulnerability  to VMware in October last y...

Proof-of-concept exploit code has been published online earlier today, and active scans for vulnerable VMware systems have been detected already.

minute read Share this article: The vulnerability, one of three patched by the company this week, could allow threat actors to breach the external perimeter of a data center or leverage backdoors already installed to take over a system. Click to Register VMware has patched three vulnerabilities in its virtual-machine infrastructure for data centers, the most serious of which is a remote code execution (RCE) flaw in its vCenter Server management platform. The vulnerability could all...