VMware Patched critical flaw in Aria Operations

VMware revealed several critical vulnerabilities in its Aria Operations product, with the most severe allowing attackers to gain root user privileges on affected systems.

The advisory, VMSA-2024-0022, released on November 26, 2024, addresses five distinct vulnerabilities:

• International

YouTube geo-blocks at least 4 Bangladeshi TV channels in India

By infosecbulletin / Friday , May 9 2025

YouTube has restricted access to at least four Bangladeshi television channels in India following a takedown request from the Indian...

Read More

• Alert

Microsoft Patches Four Critical Azure and Power Apps Vulns

By infosecbulletin / Friday , May 9 2025

Microsoft has fixed critical vulnerabilities in its core cloud services, including Azure Automation, Azure Storage, Azure DevOps, and Microsoft Power...

Read More

• Uncategorized

Qilin Ransomware topped April 2025 with 45+ data leak disclosures

By infosecbulletin / Thursday , May 8 2025

The cyber threat landscape is rapidly changing, with a notable increase in ransomware activity in April 2025, driven by the...

Read More

• Alert
• Vulnerabilities

SonicWall Patches 3 Flaws in SMA 100 Devices

By infosecbulletin / Thursday , May 8 2025

SonicWall has released patches for three security flaws in SMA 100 Secure Mobile Access appliances that could allow remote code...

Read More

• Cyber Attack
• Ransomware

Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed

By infosecbulletin / Thursday , May 8 2025

From April 2024 to April 2025, Flashpoint analysts noted that the financial sector was a major target for threat actors,...

Read More

• Alert
• Vulnerabilities

Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA

By infosecbulletin / Thursday , May 8 2025

Cisco has issued a security advisory for a critical vulnerability in its IOS XE Software for Wireless LAN Controllers (WLCs)....

Read More

• Alert
• Hot Topic
• International

CVE-2025-29824
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day

By infosecbulletin / Wednesday , May 7 2025

Attackers linked to the Play ransomware operation deployed a zero-day privilege escalation exploit during an attempted attack against an organization...

Read More

• Alert

Hacker exploited Samsung MagicINFO 9 Server RCE flaw

By infosecbulletin / Wednesday , May 7 2025

Hackers are exploiting an unauthenticated remote code execution vulnerability in the Samsung MagicINFO 9 Server to take control of devices...

Read More

• Alert

CISA adds Langflow flaw to its KEV catalog

By infosecbulletin / Tuesday , May 6 2025

CISA added the Langflow vulnerability, CVE-2025-3248 (CVSS score 9.8), to its Known Exploited Vulnerabilities catalog. Langflow is a popular tool...

Read More

• Alert
• Vulnerabilities

Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers

By infosecbulletin / Tuesday , May 6 2025

Google has released its monthly Android security updates, addressing 46 vulnerabilities, including one that has been actively exploited. CVE-2025-27363 (CVSS...

Read More

CVE-2024-38831 is a local privilege escalation vulnerability with a CVSSv3 score of 7.8.

CVE-2024-38832 is a stored XSS vulnerability that has a CVSSv3 score of 7.1.

CVE-2024-38833 is a stored XSS vulnerability with a CVSSv3 score of 6.8.

CVE-2024-38834: A third stored XSS vulnerability with a CVSSv3 score of 6.5.

Stored XSS vulnerabilities (CVE-2024-38832, CVE-2024-38833, CVE-2024-38834) let attackers with editing permissions inject harmful scripts into views, email templates, and cloud provider settings. These scripts can run when other users access those parts of the application.

Vulnerabilities affect VMware Aria Operations versions 8.x up to 8.18.1, as well as VMware Cloud Foundation versions 4.x and 5.x that include it.

Patches Released:

VMware has issued patches for vulnerabilities, and users should update to version 8.18.2 of VMware Aria Operations to fix all five issues. Since there are no workarounds, it’s important for organizations to apply the patches promptly.

VMware has recognized several security researchers, including those from MoyunSec Vlab, Bing, and the Michelin CERT team, for responsibly reporting vulnerabilities.