CVE-2008-3514

VMware VirtualCenter 2.5 before Update 2 and 2.0.2 before Update 5 relies on client-side "enabled/disabled functionality" for access control, which allows remote attackers to determine valid user names by enabling functionality in the GUI and then making an "attempt to assign permissions to other system users."

• CWE-200

• http://secunia.com/advisories/31468Vendor Advisory
• http://securityreason.com/securityalert/4150
• http://www.insomniasec.com/advisories/ISVA-080812.1.htm
• http://www.securityfocus.com/archive/1/495386/100/0/threaded
• http://www.securityfocus.com/bid/30664
• http://www.securitytracker.com/id?1020693
• http://www.vmware.com/security/advisories/VMSA-2008-0012.htmlPatch, Vendor Advisory
• http://www.vmware.com/support/vi3/doc/releasenotes_vc202u5.html
• http://www.vupen.com/english/advisories/2008/2363Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44425
• http://secunia.com/advisories/31468Vendor Advisory
• http://securityreason.com/securityalert/4150
• http://www.insomniasec.com/advisories/ISVA-080812.1.htm
• http://www.securityfocus.com/archive/1/495386/100/0/threaded
• http://www.securityfocus.com/bid/30664
• http://www.securitytracker.com/id?1020693
• http://www.vmware.com/security/advisories/VMSA-2008-0012.htmlPatch, Vendor Advisory
• http://www.vmware.com/support/vi3/doc/releasenotes_vc202u5.html
• http://www.vupen.com/english/advisories/2008/2363Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44425

Published

Aug 13, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-3508LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows …
• CVE-2008-3509LoveCMS 1.6.2 does not require administrative authentication…
• CVE-2008-3510Cross-site scripting (XSS) vulnerability in livehelp_js.php …
• CVE-2008-3511Multiple cross-site scripting (XSS) vulnerabilities in Softb…
• CVE-2008-3512SQL injection vulnerability in the Kleinanzeigen module for …
• CVE-2008-3513SQL injection vulnerability in the Book Catalog module 1.0 f…
• CVE-2008-3515Multiple cross-site scripting (XSS) vulnerabilities in files…
• CVE-2008-3516Multiple cross-site scripting (XSS) vulnerabilities in files…
• CVE-2008-3517Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2008-3518Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2008-3519The default configuration of the JBossAs component in Red Ha…
• CVE-2008-3520Multiple integer overflows in JasPer 1.900.1 might allow con…