VMware Application Remote Collector vulnerabilities

2 CVEs affecting VMware Application Remote Collector, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-11652, published 2020-04-30.

More from VMware.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-11651: SaltStack Salt Authentication Bypass Vulnerability, published 2020-04-30. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 96.6% chance of exploitation in the next 30 days. An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access…
• CVE-2020-11652: SaltStack Salt Path Traversal Vulnerability, published 2020-04-30. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 86.2% chance of exploitation in the next 30 days. An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods…