VMware Patched critical flaw in Aria Operations

VMware revealed several critical vulnerabilities in its Aria Operations product, with the most severe allowing attackers to gain root user privileges on affected systems.

The advisory, VMSA-2024-0022, released on November 26, 2024, addresses five distinct vulnerabilities:

• Alert
• Vulnerabilities

Samsung phone is saving your passwords in plain text

By infosecbulletin / Sunday , April 20 2025

You copy a password from your manager, thinking it's safe. Meanwhile, your phone is saving it in plain text. Samsung...

Read More

• Cyber Attack
• Data Breach

UK Software Firm Exposed 8 million of Healthcare Worker Records

By infosecbulletin / Saturday , April 19 2025

A data leak involving 8 million UK healthcare worker records, including IDs and financial information, was caused by a misconfigured...

Read More

• Alert
• Vulnerabilities

GitHub Enterprise Server Vulns Expose Risk of Code Execution

By infosecbulletin / Saturday , April 19 2025

GitHub has released security updates for GitHub Enterprise Server to fix several vulnerabilities, including a high-severity flaw that could allow...

Read More

• Alert
• Vulnerabilities

CVE-2025-2492
ASUS warns of critical auth bypass flaw in routers

By infosecbulletin / Friday , April 18 2025

Hackers can exploit a vulnerability in Asus routers to execute unauthorized functions. This serious issue, rated 9.2 out of 10,...

Read More

• Alert
• Hot Topic
• International
• Vulnerabilities

16,000+ Fortinet devices compromised with symlink backdoor, Mostly in Asia

By infosecbulletin / Friday , April 18 2025

According to Shadowserver Foundation around 17,000 Fortinet devices worldwide have been compromised using a new technique called "symlink". This number...

Read More

• Alert
• Vulnerabilities

Patch now! Critical Erlang/OTP SSH Vuln Allows UCE

By infosecbulletin / Friday , April 18 2025

A critical security flaw has been found in the Erlang/Open Telecom Platform (OTP) SSH implementation, allowing an attacker to run...

Read More

• Alert
• Vulnerabilities

CISA warns of increasing risk tied to Oracle legacy Cloud leak

By infosecbulletin / Thursday , April 17 2025

On Wednesday, CISA alerted about increased breach risks due to the earlier compromise of legacy Oracle Cloud servers, emphasizing the...

Read More

• Alert
• Vulnerabilities

CVE-2025-20236
Cisco Patches Unauthenticated RCE Flaw in Webex App

By infosecbulletin / Thursday , April 17 2025

Cisco issued a security advisory about a serious vulnerability in its Webex App that allows unauthenticated remote code execution (RCE)...

Read More

• Alert
• Vulnerabilities

Apple released emergency security updates for 2 zero-day vulns

By infosecbulletin / Thursday , April 17 2025

On Wednesday, Apple released urgent operating system updates to address two security vulnerabilities that had already been exploited in highly...

Read More

• Alert
• Vulnerabilities

Oracle Released Patched for 378 flaws for April 2025

By infosecbulletin / Wednesday , April 16 2025

On April 15, 2025, Oracle released a Critical Patch Update for 378 flaws for its products. The patch update covers...

Read More

CVE-2024-38831 is a local privilege escalation vulnerability with a CVSSv3 score of 7.8.

CVE-2024-38832 is a stored XSS vulnerability that has a CVSSv3 score of 7.1.

CVE-2024-38833 is a stored XSS vulnerability with a CVSSv3 score of 6.8.

CVE-2024-38834: A third stored XSS vulnerability with a CVSSv3 score of 6.5.

Stored XSS vulnerabilities (CVE-2024-38832, CVE-2024-38833, CVE-2024-38834) let attackers with editing permissions inject harmful scripts into views, email templates, and cloud provider settings. These scripts can run when other users access those parts of the application.

Vulnerabilities affect VMware Aria Operations versions 8.x up to 8.18.1, as well as VMware Cloud Foundation versions 4.x and 5.x that include it.

Patches Released:

VMware has issued patches for vulnerabilities, and users should update to version 8.18.2 of VMware Aria Operations to fix all five issues. Since there are no workarounds, it’s important for organizations to apply the patches promptly.

VMware has recognized several security researchers, including those from MoyunSec Vlab, Bing, and the Michelin CERT team, for responsibly reporting vulnerabilities.