Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Unauthorized RCE in VMware vCenter

swarm.ptsecurity.com | vulnerability | #rce | #vulnerability-research | #vmware | #cve | #ssrf

Summary

Technical details of the VMware vSphere Client flaws found in fall 2020: an unauthorized file upload in the vropspluginui plugin leading to RCE (CVE-2021-21972) and an unauthenticated SSRF (CVE-2021-21973), both exploitable without credentials.
Published
Collected

original ↗

Related coverage

  1. Vulnerabilities in the Openfire Admin Console (swarm.ptsecurity.com)
  2. Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase (hackerone.com)
  3. How to Chain Vulnerabilities for RCE: From Image Metadata to Complete System Compromise (hackenproof.com)
  4. Catching bugs in VMware: Carbon Black Cloud Workload Appliance and vRealize Operations Manager (swarm.ptsecurity.com)
  5. Hunting for bugs in VMware: View Planner and vRealize Business for Cloud (swarm.ptsecurity.com)
  6. Chaining N-days to Compromise All: Part 5 — VMware Workstation Guest-to-Host Escape (theori.io)

back