Mikhail Stepanin

The issue is related to a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. This is due to the failure to properly handle CRLF sequences, allowing user-supplied data to be added to HTTP response headers without proper processing. As a result, an attacker can control HTTP response headers and bodies, potentially leading to cross-site scripting attacks and attacks on intermediate proxy servers.

The issue is related to an XML External Entity (XXE) problem, where an XML document containing an external entity declaration in conjunction with an entity reference can be used to read arbitrary files. This is due to incorrect restriction of XML links to external objects. Exploitation of the issue may allow a remote attacker to access confidential information by convincing a user to connect to a malicious vCenter or ESXi server.

The issue is related to an XML External Entity (XXE) problem, where there is an incorrect restriction of XML links to external objects. This can be exploited by a remote attacker to gain access to confidential information by sending a specially crafted XML request to the server. The exploitation is possible through the Log Browser, Distributed Switch setup, or Content Library XML document.

The issue is related to the Single Sign-On feature in VMware products, specifically an XML External Entity (XXE) problem. This is due to incorrect restriction of XML links to external objects. Exploitation can allow a remote attacker to cause a denial of service or gain access to confidential information by using specially crafted XML requests. The vulnerability can be exploited by sending an XML document containing an external entity declaration in conjunction with an entity reference, allowing attackers to read arbitrary files.