VMware fixes three critical flaws allowing auth bypass, VM escapes
Teaser from the source
Broadcom has released security updates to fix five vulnerabilities in VMware vCenter, ESX, Workstation, and Fusion, including three critical flaws that allow attackers to bypass authentication, execute arbitrary code, or escape from a virtual machine to the host. [...]
This is the RSS-feed teaser. Read the full article at the original source.
Read at BleepingComputerMore on allowing
Other advisories
- MediumCVE-2026-112164The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the appli…
- MediumCVE-2026-112165The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the-middle attacker …
- HighCVE-2026-118468XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Enti…
- MediumCVE-2026-118795Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.
- Not ratedosv:CLEANSTART-2026-TJ33106vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace ...
- Not ratedosv:CLEANSTART-2024-UQ73380Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, dec...
- Not ratedosv:CLEANSTART-2024-DU28506Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access poin...
- Not ratedosv:CLEANSTART-2024-XY23139Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access point...
Other news entries
- Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start CarsNewsThe Hacker News
- DigiCert data breach exposes customer information, identity documentsNewsBleepingComputer
- Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command ExecutionNewsThe Hacker News
- Barracuda warns of critical flaws allowing root access to devicesNewsBleepingComputer
- A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private ChatsNewsThe Hacker News
- Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security BypassNewsThe Hacker News
- Tailscale warns of SSH flaws allowing root privilege escalationNewsBleepingComputer
- Google, Mozilla revoke eMudhra intermediates after private key compromiseNewsCSO Online
ID