Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hunting for bugs in VMware: View Planner and vRealize Business for Cloud

swarm.ptsecurity.com | vulnerability | #cloud | #rce | #vulnerability-research | #vmware | #cve | #command-injection

Summary

PT SWARM uncovers unauthenticated RCEs in VMware View Planner (CVE-2021-21978) and vRealize Business for Cloud (CVE-2021-21984). The View Planner flaw traces to an unauthenticated WSGI log-upload endpoint in its dockerized web stack, leading to command execution.
Published
Collected

original ↗

Related coverage

  1. Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise (wiz.io)
  2. CVE-2022-22947: Spring Cloud Gateway Code Injection Vulnerability (blog.viettelcybersecurity.com)
  3. Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase (hackerone.com)
  4. The CVE spike across major software companies is a remediation problem (aikido.dev)
  5. How to Chain Vulnerabilities for RCE: From Image Metadata to Complete System Compromise (hackenproof.com)
  6. Catching bugs in VMware: Carbon Black Cloud Workload Appliance and vRealize Operations Manager (swarm.ptsecurity.com)

back