Vmware Cloud_foundation
136 CVEs affecting Vmware Cloud_foundation. Latest disclosed: 2026-06-08. Critical: 18, High: 68.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-34063 | Critical | 9.9 | 2024-01-16 | Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized acc… |
CVE-2024-38812 | Critical | 9.8 | 2024-09-17 | The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server… |
CVE-2024-37080 | Critical | 9.8 | 2024-06-18 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may… |
CVE-2024-37079 | Critical | 9.8 | 2024-06-18 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may… |
CVE-2023-20864 | Critical | 9.8 | 2023-04-20 | VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for… |
CVE-2022-22972 | Critical | 9.8 | 2022-05-20 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious… |
CVE-2022-22954 | Critical | 9.8 | 2022-04-11 | VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with ne… |
CVE-2021-22005 | Critical | 9.8 | 2021-09-23 | The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Serve… |
CVE-2021-22002 | Critical | 9.8 | 2021-08-31 | VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom hos… |
CVE-2021-21994 | Critical | 9.8 | 2021-07-13 | SFCB (Small Footprint CIM Broker) as used in ESXi has an authentication bypass vulnerability. A malicious actor with network access to port 5989 on ESXi may ex… |
CVE-2021-21986 | Critical | 9.8 | 2021-05-26 | The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Ma… |
CVE-2021-21985 | Critical | 9.8 | 2021-05-26 | The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enab… |
CVE-2021-21972 | Critical | 9.8 | 2021-02-24 | The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exp… |
CVE-2020-3992 | Critical | 9.8 | 2020-10-20 | OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issu… |
CVE-2025-22224 | Critical | 9.3 | 2025-03-04 | VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local admi… |
CVE-2024-22253 | Critical | 9.3 | 2024-03-05 | VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges… |
CVE-2022-31678 | Critical | 9.1 | 2022-10-28 | VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit… |
CVE-2020-4006 | Critical | 9.1 | 2020-11-23 | VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability. |
CVE-2023-20877 | High | 8.8 | 2023-05-12 | VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leadi… |
CVE-2022-31696 | High | 8.8 | 2022-12-13 | VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may expl… |