CVE-2014-8370

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allow host OS users to gain host OS privileges or cause a denial of service (arbitrary write to a file) by modifying a configuration file.

Metrics

CVSS 2.0 6.4/10AV:N/AC:L/Au:N/C:N/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN88252465/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000007Third Party Advisory, VDB Entry
http://secunia.com/advisories/62551
http://secunia.com/advisories/62605
http://secunia.com/advisories/62669
http://www.securityfocus.com/bid/72338Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1031642Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1031643Third Party Advisory, VDB Entry
http://www.vmware.com/security/advisories/VMSA-2015-0001.htmlPatch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/100933
http://jvn.jp/en/jp/JVN88252465/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000007Third Party Advisory, VDB Entry
http://secunia.com/advisories/62551
http://secunia.com/advisories/62605
http://secunia.com/advisories/62669
http://www.securityfocus.com/bid/72338Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1031642Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1031643Third Party Advisory, VDB Entry
http://www.vmware.com/security/advisories/VMSA-2015-0001.htmlPatch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/100933

Timeline

Published: Jan 29, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-83714.3VMware vCenter Server Appliance (vCSA) 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certifi CVE-2014-83724.0AirWatch by VMware On-Premise 7.3.x before 7.3.3.0 (FP3) allows remote authenticated users to obtain the organizational information and stat CVE-2014-83739.0The VMware Remote Console (VMRC) function in VMware vCloud Automation Center (vCAC) 6.0.1 through 6.1.1 allows remote authenticated users to CVE-2014-83756.5SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute ar CVE-2014-83763.5Cross-site scripting (XSS) vulnerability in the context administration sub-panel in the Site Banner module before 7.x-4.1 for Drupal allows CVE-2014-83774.3Cross-site scripting (XSS) vulnerability in Webasyst Shop-Script 5.2.2.30933 allows remote attackers to inject arbitrary web script or HTML CVE-2014-83783.5Cross-site scripting (XSS) vulnerability in the TableField module 7.x-2.x before 7.x-2.3 allows remote authenticated users with the "adminis CVE-2014-83793.5Multiple cross-site scripting (XSS) vulnerabilities in the Marketo MA module before 7.x-1.5 for Drupal allow remote authenticated users with CVE-2014-83804.3Cross-site scripting (XSS) vulnerability in Splunk 6.1.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer CVE-2014-83814.3Multiple cross-site scripting (XSS) vulnerabilities in Megapolis.Portal Manager allow remote attackers to inject arbitrary web script or HTM CVE-2014-838310.0The InFocus IN3128HD projector with firmware 0.26 allows remote attackers to bypass authentication via a direct request to main.html.CVE-2014-83849.4The InFocus IN3128HD projector with firmware 0.26 does not restrict access to cgi-bin/webctrl.cgi.elf, which allows remote attackers to modi