Total
95 CVE
CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
---|---|---|---|---|---|
CVE-2021-21973 | 1 Vmware | 2 Cloud Foundation, Vcenter Server | 2024-02-15 | 5.0 MEDIUM | 5.3 MEDIUM |
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2). | |||||
CVE-2021-21972 | 1 Vmware | 2 Cloud Foundation, Vcenter Server | 2024-02-13 | 10.0 HIGH | 9.8 CRITICAL |
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2). | |||||
CVE-2023-34063 | 1 Vmware | 2 Aria Automation, Cloud Foundation | 2024-01-25 | N/A | 8.3 HIGH |
Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows. | |||||
CVE-2023-34043 | 1 Vmware | 2 Aria Operations, Cloud Foundation | 2023-12-10 | N/A | 6.7 MEDIUM |
VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'. | |||||
CVE-2023-20864 | 1 Vmware | 2 Aria Operations For Logs, Cloud Foundation | 2023-12-10 | N/A | 9.8 CRITICAL |
VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root. | |||||
CVE-2023-20877 | 1 Vmware | 2 Cloud Foundation, Vrealize Operations | 2023-12-10 | N/A | 8.8 HIGH |
VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leading to privilege escalation. | |||||
CVE-2023-20879 | 1 Vmware | 2 Cloud Foundation, Vrealize Operations | 2023-12-10 | N/A | 6.7 MEDIUM |
VMware Aria Operations contains a Local privilege escalation vulnerability. A malicious actor with administrative privileges in the Aria Operations application can gain root access to the underlying operating system. | |||||
CVE-2023-20878 | 1 Vmware | 2 Cloud Foundation, Vrealize Operations | 2023-12-10 | N/A | 7.2 HIGH |
VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt the system. | |||||
CVE-2023-20884 | 3 Linux, Microsoft, Vmware | 6 Linux Kernel, Windows, Cloud Foundation and 3 more | 2023-12-10 | N/A | 6.1 MEDIUM |
VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect a victim to an attacker controlled domain due to improper path handling leading to sensitive information disclosure. | |||||
CVE-2023-20865 | 1 Vmware | 2 Aria Operations For Logs, Cloud Foundation | 2023-12-10 | N/A | 7.2 HIGH |
VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root. | |||||
CVE-2023-20880 | 1 Vmware | 2 Aria Operations, Cloud Foundation | 2023-12-10 | N/A | 6.7 MEDIUM |
VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'. | |||||
CVE-2022-31701 | 2 Linux, Vmware | 4 Linux Kernel, Access, Cloud Foundation and 1 more | 2023-12-10 | N/A | 5.3 MEDIUM |
VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3. | |||||
CVE-2022-31698 | 1 Vmware | 2 Cloud Foundation, Vcenter Server | 2023-12-10 | N/A | 5.3 MEDIUM |
The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to trigger a denial-of-service condition by sending a specially crafted header. | |||||
CVE-2022-31700 | 2 Microsoft, Vmware | 4 Windows, Access, Cloud Foundation and 1 more | 2023-12-10 | N/A | 7.2 HIGH |
VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2. | |||||
CVE-2022-31697 | 1 Vmware | 2 Cloud Foundation, Vcenter Server | 2023-12-10 | N/A | 5.5 MEDIUM |
The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with access to a workstation that invoked a vCenter Server Appliance ISO operation (Install/Upgrade/Migrate/Restore) can access plaintext passwords used during that operation. | |||||
CVE-2022-31696 | 1 Vmware | 2 Cloud Foundation, Esxi | 2023-12-10 | N/A | 8.8 HIGH |
VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory leading to an escape of the ESXi sandbox. | |||||
CVE-2022-31699 | 1 Vmware | 2 Cloud Foundation, Esxi | 2023-12-10 | N/A | 3.3 LOW |
VMware ESXi contains a heap-overflow vulnerability. A malicious local actor with restricted privileges within a sandbox process may exploit this issue to achieve a partial information disclosure. | |||||
CVE-2022-31681 | 1 Vmware | 2 Cloud Foundation, Esxi | 2023-12-10 | N/A | 6.5 MEDIUM |
VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a denial of service condition on the host. | |||||
CVE-2022-22982 | 1 Vmware | 2 Cloud Foundation, Vcenter Server | 2023-12-10 | N/A | 7.5 HIGH |
The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service. | |||||
CVE-2022-31678 | 1 Vmware | 2 Cloud Foundation, Nsx Data Center | 2023-12-10 | N/A | 9.1 CRITICAL |
VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure. |