InfoSecBulletin Cybersecurity for mankind
VMware revealed several critical vulnerabilities in its Aria Operations product, with the most severe allowing attackers to gain root user privileges on affected systems.
The advisory, VMSA-2024-0022, released on November 26, 2024, addresses five distinct vulnerabilities:
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
CVE-2024-38831 is a local privilege escalation vulnerability with a CVSSv3 score of 7.8.
CVE-2024-38832 is a stored XSS vulnerability that has a CVSSv3 score of 7.1.
CVE-2024-38833 is a stored XSS vulnerability with a CVSSv3 score of 6.8.
CVE-2024-38834: A third stored XSS vulnerability with a CVSSv3 score of 6.5.
Stored XSS vulnerabilities (CVE-2024-38832, CVE-2024-38833, CVE-2024-38834) let attackers with editing permissions inject harmful scripts into views, email templates, and cloud provider settings. These scripts can run when other users access those parts of the application.
Vulnerabilities affect VMware Aria Operations versions 8.x up to 8.18.1, as well as VMware Cloud Foundation versions 4.x and 5.x that include it.
Patches Released:
VMware has issued patches for vulnerabilities, and users should update to version 8.18.2 of VMware Aria Operations to fix all five issues. Since there are no workarounds, it’s important for organizations to apply the patches promptly.
VMware has recognized several security researchers, including those from MoyunSec Vlab, Bing, and the Michelin CERT team, for responsibly reporting vulnerabilities.
