The client also had a long and difficult development history, requiring more than two years to match the functionality of a Flash-based tool and a justifiably unloved C# client.Īdding further complications, VMware has extended the supported lifespan of some vCenter versions that shipped with the Flash client, meaning those who persist with those versions will also need to maintain old-school browsers that still support Adobe’s dangerous Flash-rendering code. The first, revealed in February, was also rated 9.8. This native backup solution is available within the VMware Appliance Management Interface on port 5480. One of those features was the built-in file-based backup and restore. But this is the second critical flaw found in the vSphere HTML5 client this year alone. The vCenter Server Appliance (VCSA) had several exclusive features introduced in vSphere 6.5. Now it says you need its new stuff to do it rightĮvery vendor has bugs and plenty of them are nasty.

In 2020, VMware said its remote work kit was brilliant.

India’s massive COVID-19 wave slows VMware desktop hypervisor development.

VMware amends bug report claiming ‘Unauthorized API’ behind critical flaw - now says it's an 'unauthorised end point'.

With Gelsinger back at Intel, VMware picks new CEO from within, shakes up execs.

The Content APIs provide services to manage and configure content libraries.

Common Infrastructure Services(CIS) The CIS APIs provide VMware common infrastructure services such as session management, tags, and task management. And seeing as the Site Recovery plugin is a disaster recovery tool, The Register shudders at the possibilities if an attacker managed to both introduce ransomware and mess with recovery infrastructure. The Appliance APIs provides services for managing vCenter Appliance configuration. VMware has also reported CVE-2021-21986, an authentication mechanism vulnerability in the vSphere HTML 5 client that is also bad news for the Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plugins.Īn unauthenticated attacker with access to the same port 443 could make the plugins dance to their tune.

Vmware vcenter client