CVE-2016-5330

Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation Pro 12.1.x before 12.1.1, VMware Workstation Player 12.1.x before 12.1.1, and VMware Fusion 8.1.x before 8.1.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory.

• CWE-426

• http://www.rapid7.com/db/modules/exploit/windows/misc/vmhgfs_webdav_dll_sideloadThird Party Advisory
• http://www.securityfocus.com/archive/1/539131/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/92323Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036544Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036545Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036619Third Party Advisory, VDB Entry
• http://www.vmware.com/security/advisories/VMSA-2016-0010.htmlMitigation, Vendor Advisory
• https://securify.nl/advisory/SFY20151201/dll_side_loading_vulnerability_in_vmware_host_guest_client_redirector.htmlExploit, Third Party Advisory
• http://www.rapid7.com/db/modules/exploit/windows/misc/vmhgfs_webdav_dll_sideloadThird Party Advisory
• http://www.securityfocus.com/archive/1/539131/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/92323Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036544Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036545Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036619Third Party Advisory, VDB Entry
• http://www.vmware.com/security/advisories/VMSA-2016-0010.htmlMitigation, Vendor Advisory
• https://securify.nl/advisory/SFY20151201/dll_side_loading_vulnerability_in_vmware_host_guest_client_redirector.htmlExploit, Third Party Advisory

Published

Aug 8, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-5321The DumpModeDecode function in libtiff 4.0.6 and earlier all…
• CVE-2016-5322The setByteArray function in tif_dir.c in libtiff 4.0.6 and …
• CVE-2016-5323The _TIFFFax3fillruns function in libtiff before 4.0.6 allow…
• CVE-2016-5325CRLF injection vulnerability in the ServerResponse#writeHead…
• CVE-2016-5328VMware Tools 9.x and 10.x before 10.1.0 on OS X, when System…
• CVE-2016-5329VMware Fusion 8.x before 8.5 on OS X, when System Integrity …
• CVE-2016-5331CRLF injection vulnerability in VMware vCenter Server 6.0 be…
• CVE-2016-5332Directory traversal vulnerability in VMware vRealize Log Ins…
• CVE-2016-5333VMware Photos OS OVA 1.0 before 2016-08-14 has a default SSH…
• CVE-2016-5334VMware Identity Manager 2.x before 2.7.1 and vRealize Automa…5.3
• CVE-2016-5335VMware Identity Manager 2.x before 2.7 and vRealize Automati…7.8
• CVE-2016-5336VMware vRealize Automation 7.0.x before 7.1 allows remote at…