VMware Fixed Multiple Flaws Allow Attackers to Inject Malicious Scripts

Broadcom has revealed three stored cross-site scripting (XSS) flaws that affect VMware Cloud Foundation Operations and some other products. They warn that attackers who are logged in could add harmful scripts to do admin tasks in the system.

Tracked as CVE-2026-41722, CVE-2026-41723, and CVE-2026-41724, the issues were fixed in the security notice VMSA-2026-0004, released on June 8, 2026.

• Uncategorized

WhatsApp to allow usernames instead of phone numbers

By infosecbulletin / Tuesday , June 30 2026

WhatsApp is about to release a big update that may change how people communicate on the app. Soon, users can...

Read More

• International

Linux Unveils New Open Source Security Project “Akrites” For (OSS) Ecosystem

By infosecbulletin / Monday , June 29 2026

The Linux Foundation said on Thursday that they are starting a new project to fix flaws in open source software...

Read More

• Data Breach

Data breach affects 14.2 million email logins across six ISPs

By infosecbulletin / Sunday , June 28 2026

KDDI Corporation, a Japanese telecom company, revealed a data breach. Hackers got into one of its email systems that five...

Read More

• Hot Topic

Asian Two AI startups launch Mythos-like Model

By infosecbulletin / Sunday , June 28 2026

Two Asian AI companies have released new models this week that compete with Anthropic’s recently limited Mythos and Fable models,...

Read More

• Data Breach

Polymarket Hack Reportedly Results in $3 Million Theft

By infosecbulletin / Saturday , June 27 2026

Polymarket is a platform for prediction markets using cryptocurrency. It lets users bet on what might happen in real-life events...

Read More

• International

Anthropic Confirms US Infrastructure Redeployment of Claude Mythos 5

By infosecbulletin / Saturday , June 27 2026

Anthropic said that Claude Mythos 5, its strongest AI security model, will be sent back to some U.S. orgs that...

Read More

• International

Hackers Target Cloudflare-Hosted AWS Domains to Steal Console Logins

By infosecbulletin / Friday , June 26 2026

A complex phishing attack targets AWS console users by misusing Cloudflare-hosted websites to steal login details. Each domain had a nearly...

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 26. 06. 2026

By infosecbulletin / Friday , June 26 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• International

WhatsApp to Alert Users Before Chatting With New Numbers

By infosecbulletin / Thursday , June 25 2026

WhatsApp is rolling a new security warning on Android and iOS. It shows up before users open a chat with...

Read More

• Hot Topic

OpenAI unveils its first custom chip, Named Jalapeño

By infosecbulletin / Wednesday , June 24 2026

On Wednesday, OpenAI introduced its first special AI chip. This is aimed at growing from just consumer products to being...

Read More

VMware Stored XSS Vulnerabilities

VMware Cloud Foundation Operations has several stored cross-site scripting flaws caused by not properly checking user input.

Stored XSS is more dangerous than reflected XSS because the harmful code stays on the server and runs every time a victim opens the affected part, allowing repeated attacks on many users.

The flaws were shared privately with Broadcom by Alexis Bernazzani from Visa Inc. The notice covers many Broadcom virtualization products, such as VMware Aria Operations, VMware Cloud Foundation Operations, VMware Cloud Foundation, VMware vSphere Foundation, and VMware Telco Cloud Platform. Broadcom has put out fixes and updates that companies should use based on the Response Matrix.

Administrators should prioritize applying the listed fixed versions promptly, given the absence of any workaround.

Organizations should check who has roles and limit permissions for making policies, views, and text-widgets. This will reduce the number of accounts that can cause these problems while fixes are being applied.