VMware fixes three critical flaws allowing auth bypass, VM escapes
Teaser from the source
Broadcom has released security updates to fix five vulnerabilities in VMware vCenter, ESX, Workstation, and Fusion, including three critical flaws that allow attackers to bypass authentication, execute arbitrary code, or escape from a virtual machine to the host. [...]
This is the RSS-feed teaser. Read the full article at the original source.
Read at BleepingComputerMore on allowing
Other advisories
- Not ratedosv:CLEANSTART-2026-TJ33106vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace ...
- Not ratedosv:CLEANSTART-2024-UQ73380Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, dec...
- Not ratedosv:CLEANSTART-2024-DU28506Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access poin...
- Not ratedosv:CLEANSTART-2024-XY23139Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access point...
- Not ratedosv:CVE-2026-78190WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting
- Not ratedosv:CLEANSTART-2024-ZR42121iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame
- Not ratedosv:CLEANSTART-2024-XM31676GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed
- Not ratedosv:CLEANSTART-2024-WY17138crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap
Other news entries
- DigiCert data breach exposes customer information, identity documentsNewsBleepingComputer
- Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command ExecutionNewsThe Hacker News
- Barracuda warns of critical flaws allowing root access to devicesNewsBleepingComputer
- A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private ChatsNewsThe Hacker News
- Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security BypassNewsThe Hacker News
- Tailscale warns of SSH flaws allowing root privilege escalationNewsBleepingComputer
- Google, Mozilla revoke eMudhra intermediates after private key compromiseNewsCSO Online
- DeepSeek deep-sixed at all US federal civilian agenciesNewsThe Register — Security
ID