CVE-2017-4926
published 2017-09-15CVE-2017-4926: VMware vCenter Server (6.5 prior to 6.5 U1) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker with VC user privileges…
PriorityP424medium5.4CVSS 3.0
AVNACLPRLUIRSCCLILAN
EPSS
0.78%
55.6th percentile
VMware vCenter Server (6.5 prior to 6.5 U1) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker with VC user privileges can inject malicious java-scripts which will get executed when other VC users access the page.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | fusion_pro | — | — |
| vmware | vcenter_server | — | — |
| vmware | vcenter_server | — | — |
| vmware | vmware_esxi | — | — |
| vmware | vmware_fusion | — | — |
| vmware | vmware_vcenter_server | — | — |
| vmware | vmware_workstation | — | — |
| vmware | vsphere | — | — |
| vmware | workstation_player | — | — |
| vmware | workstation_pro | — | — |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2pr6-vhmf-w3qp: VMware vCenter Server (6
ghsa_unreviewed·2022-05-17
CVE-2017-4926 [MEDIUM] CWE-79 GHSA-2pr6-vhmf-w3qp: VMware vCenter Server (6
VMware vCenter Server (6.5 prior to 6.5 U1) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker with VC user privileges can inject malicious java-scripts which will get executed when other VC users access the page.
VMware
VMware ESXi, vCenter Server, Fusion and Workstation updates resolve multiple security vulnerabilities
vendor_vmware·2017-09-14·CVSS 8.8
CVE-2017-4924 [HIGH] VMware ESXi, vCenter Server, Fusion and Workstation updates resolve multiple security vulnerabilities
VMSA-2017-0015: VMware ESXi, vCenter Server, Fusion and Workstation updates resolve multiple security vulnerabilities
VMware ESXi, vCenter Server, Fusion and Workstation updates resolve multiple security vulnerabilities. 2. Relevant Products VMware ESXi (ESXi) VMware vCenter Server VMware Workstation Pro / Player (Workstation) VMware Fusion Pro, Fusion (Fusion)3. Problem Description a. Out-of-bounds write vulnerability in SVGA VMware ESXi, Workstation and Fusion contain an out-of-bounds write vulnerability in SVGA device. This issue may allow a guest to execute code on the host. VMware would like to thank Nico Golde and Ralf-Philipp Weinmann of Comsecuris UG (haftungsbeschraenkt) working with ZDI for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.o
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-09-15
Published