Security News > 2020 > November > VMware Working on Patches for Critical Workspace ONE Access Vulnerability
VMware on Monday published an advisory to inform users that it's working on patching a critical command injection vulnerability affecting Workspace ONE Access and some related components.
VMware has not specified if technical details of the vulnerability have been disclosed or if it has been exploited in attacks.
Workspace ONE Access, provides "Multi-factor authentication, conditional access and single sign-on to SaaS, web and native mobile apps." The vulnerability has been found to affect Workspace ONE Access on Linux, Identity Manager on Linux, vIDM Connector on Windows and Linux, VMware Cloud Foundation and vRealize Suite Lifecycle Manager.
VMware also informed customers recently that some of its Tanzu products are impacted by CVE-2020-15999, a vulnerability affecting FreeType, a popular software library for rendering fonts.
Earlier this month, VMware informed customers that it patched six vulnerabilities in its SD-WAN Orchestrator product, including flaws that can be exploited to steer traffic or shut down an enterprise network.
News URL
Related news
- Critical SailPoint IdentityIQ Vulnerability Exposes Files to Unauthorized Access (source)
- Veeam Issues Patch for Critical RCE Vulnerability in Service Provider Console (source)
- PoC exploit for critical WhatsUp Gold RCE vulnerability released (CVE-2024-8785) (source)
- Critical OpenWrt Vulnerability Exposes Devices to Malicious Firmware Injection (source)
- BeyondTrust Issues Urgent Patch for Critical Vulnerability in PRA and RS Products (source)
- BeyondTrust fixes critical vulnerability in remote access, support solutions (CVE-2024-12356) (source)
- Hackers Exploiting Critical Fortinet EMS Vulnerability to Deploy Remote Access Tools (source)
- Critical SQL Injection Vulnerability in Apache Traffic Control Rated 9.9 CVSS — Patch Now (source)
- Cisco fixes ClamAV vulnerability with available PoC and critical Meeting Management flaw (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-11-03 | CVE-2020-15999 | Out-of-bounds Write vulnerability in multiple products Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 6.5 |