PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Catching bugs in VMware: Carbon Black Cloud Workload Appliance and vRealize Operations Manager

swarm.ptsecurity.com | vulnerability | #cloud | #rce | #authentication-bypass | #vmware | #carbon-black | #vrealize
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part two of PT SWARM's VMware research: an auth bypass in Carbon Black Cloud Workload Appliance (CVE-2021-21978) and a chain in vRealize Operations (CVE-2021-21975/22023/21983) leading to RCE.
Published
Collected

Related coverage

research · slcyber.io
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE
Chaining an unauthenticated bulk import, an in-band XXE, leaked IMS credentials and Groovy execution into full pre-auth RCE on Adobe Experience Manager Cloud.
vulnerability · swarm.ptsecurity.com
Hunting for bugs in VMware: View Planner and vRealize Business for Cloud
PT SWARM uncovers unauthenticated RCEs in VMware View Planner (CVE-2021-21978) and vRealize Business for Cloud (CVE-2021-21984). The View Planner flaw traces to an unauthenticated WSGI log-upload endpoint in its dockerized web stack, leading to command execution.
vulnerability · swarm.ptsecurity.com
Unauthorized RCE in VMware vCenter
Technical details of the VMware vSphere Client flaws found in fall 2020: an unauthorized file upload in the vropspluginui plugin leading to RCE (CVE-2021-21972) and an unauthenticated SSRF (CVE-2021-21973), both exploitable without credentials.
vulnerability · theori.io
Chaining N-days to Compromise All: Part 5 — VMware Workstation Guest-to-Host Escape
Part five of the chain: how CVE-2023-20869 in VMware Workstation’s virtual Bluetooth SDP handling lets a guest execute arbitrary code on the host, with root-cause analysis and a working PoC.
vulnerability · theori.io
Chaining N-days to Compromise All: Part 4 — VMware Workstation Information leakage
Part four of the chain: CVE-2023-34044, Theori’s variant of CVE-2023-20870 in VMware’s virtual Bluetooth device, leaks critical information from the host process via malformed USB request blocks.
vulnerability · bishopfox.com
[CVE-2026-67279] MikroTrick: Inside the RouterOS Takeover Chain
Bishop Fox reproduced the MikroTrick RouterOS takeover chain, using CVE-2026-67279 and a second flaw for unauthenticated admin access on 7.x, and confirmed real devices were already compromised.
Back