Vmware
Page 3 of 7 — Vmware CVEs from a corpus of 615, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-22274 | High | 7.2 | 2024-05-21 | The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance she… |
CVE-2024-22273 | High | 8.1 | 2024-05-21 | The storage controllers on VMware ESXi, Workstation, and Fusion have out-of-bounds read/write vulnerability. A malicious actor with access to a virtual machine… |
CVE-2024-22270 | High | 7.1 | 2024-05-14 | VMware Workstation and Fusion contain an information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality. A malicious actor with local… |
CVE-2024-22269 | High | 7.1 | 2024-05-14 | VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device. A malicious actor with local administrative privileges… |
CVE-2024-22268 | High | 7.1 | 2024-05-14 | VMware Workstation and Fusion contain a heap buffer-overflow vulnerability in the Shader functionality. A malicious actor with non-administrative access to a v… |
CVE-2024-22267 | Critical | 9.3 | 2024-05-14 | VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virt… |
CVE-2024-22266 | Medium | 6.5 | 2024-05-08 | VMware Avi Load Balancer contains an information disclosure vulnerability. A malicious actor with access to the system logs can view cloud connection credenti… |
CVE-2024-22264 | High | 7.2 | 2024-05-08 | VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious actor with admin privileges on VMware Avi Load Balancer can create, modify… |
CVE-2024-22259 | High | 8.1 | 2024-03-16 | Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation chec… |
CVE-2024-22256 | Medium | 4.3 | 2024-03-07 | VMware Cloud Director contains a partial information disclosure vulnerability. A malicious actor can potentially gather information about organization names ba… |
CVE-2024-22255 | High | 7.1 | 2024-03-05 | VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access t… |
CVE-2024-22254 | High | 7.9 | 2024-03-05 | VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading… |
CVE-2024-22253 | Critical | 9.3 | 2024-03-05 | VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges… |
CVE-2024-22252 | Critical | 9.3 | 2024-03-05 | VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges… |
CVE-2024-22251 | Medium | 5.9 | 2024-02-29 | VMware Workstation and Fusion contain an out-of-bounds read vulnerability in the USB CCID (chip card interface device). A malicious actor with local administra… |
CVE-2024-22235 | Medium | 6.7 | 2024-02-21 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privi… |
CVE-2024-22250 | High | 7.8 | 2024-02-20 | Session Hijack vulnerability in Deprecated VMware Enhanced Authentication Plug-in could allow a malicious actor with unprivileged local access to a windows ope… |
CVE-2024-22245 | Critical | 9.6 | 2024-02-20 | Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor… |
CVE-2024-22234 | High | 7.4 | 2024-02-20 | In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly use… |
CVE-2024-22241 | Medium | 4.3 | 2024-02-06 | Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious payload into the log… |
CVE-2024-22240 | Medium | 4.9 | 2024-02-06 | Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerability leading to unauth… |
CVE-2024-22239 | Medium | 5.3 | 2024-02-06 | Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this v… |
CVE-2024-22238 | Medium | 6.4 | 2024-02-06 | Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may be able to inject malicious code into u… |
CVE-2024-22237 | High | 7.8 | 2024-02-06 | Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this v… |
CVE-2023-34042 | Medium | 4.1 | 2024-02-05 | The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with… |
CVE-2024-22236 | Low | 3.3 | 2024-01-31 | In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to loc… |
CVE-2024-22233 | High | 7.5 | 2024-01-22 | In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) co… |
CVE-2023-34063 | Critical | 9.9 | 2024-01-16 | Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized acc… |
CVE-2022-22942 | High | 7.8 | 2023-12-13 | The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the s… |
CVE-2023-34064 | Medium | 4.6 | 2023-12-12 | Workspace ONE Launcher contains a Privilege Escalation Vulnerability. A malicious actor with physical access to Workspace ONE Launcher could utilize the Edge P… |
CVE-2023-34055 | Medium | 5.3 | 2023-11-28 | In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a den… |
CVE-2023-34053 | Medium | 5.3 | 2023-11-28 | In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) cond… |
CVE-2023-34060 | Critical | 9.8 | 2023-11-14 | VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from an older vers… |
CVE-2023-31026 | Medium | 6.0 | 2023-11-02 | NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a NULL-pointer dereference may lead to deni… |
CVE-2023-31022 | Medium | 5.5 | 2023-11-02 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a NULL-pointer dereference may lead to denial of servi… |
CVE-2023-31021 | Medium | 5.5 | 2023-11-02 | NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a malicious user in the guest VM can cause… |
CVE-2023-31018 | Medium | 6.5 | 2023-11-02 | NVIDIA GPU Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a NULL-pointer derefere… |
CVE-2023-20886 | High | 8.8 | 2023-10-31 | VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve thei… |
CVE-2023-34059 | High | 7.4 | 2023-10-27 | open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack… |
CVE-2023-34058 | High | 7.1 | 2023-10-27 | VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/… |
CVE-2023-34057 | High | 7.8 | 2023-10-27 | VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may elevate privileges wi… |
CVE-2023-46120 | Medium | 4.9 | 2023-10-25 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when recei… |
CVE-2023-46118 | Medium | 4.9 | 2023-10-25 | RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (D… |
CVE-2023-44794 | Critical | 9.8 | 2023-10-25 | An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL. |
CVE-2023-34056 | Medium | 4.3 | 2023-10-25 | vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage thi… |
CVE-2023-34048 | Critical | 9.8 | 2023-10-25 | vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Ser… |
CVE-2023-34045 | Medium | 6.6 | 2023-10-20 | VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to dr… |
CVE-2023-34046 | Medium | 6.7 | 2023-10-20 | VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during installation for the first time (the user ne… |
CVE-2023-34044 | High | 7.1 | 2023-10-20 | VMware Workstation( 17.x prior to 17.5) and Fusion(13.x prior to 13.5) contain an out-of-bounds read vulnerability that exists in the functionality for sharin… |
CVE-2023-34052 | High | 7.8 | 2023-10-20 | VMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with non-administrative access to the local system can trigger the… |
CVE-2023-34051 | Critical | 9.8 | 2023-10-20 | VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system… |
CVE-2023-34050 | Medium | 5.0 | 2023-10-19 | In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing… |
CVE-2023-34043 | Medium | 6.7 | 2023-09-27 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privi… |
CVE-2023-34047 | Low | 3.1 | 2023-09-20 | A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security contex… |
CVE-2023-20900 | High | 7.1 | 2023-08-31 | A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A… |
CVE-2023-34039 | Critical | 9.8 | 2023-08-29 | Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with netwo… |
CVE-2023-20890 | High | 7.2 | 2023-08-29 | Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to VMware Aria Operati… |
CVE-2023-34040 | Medium | 5.3 | 2023-08-24 | In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configurati… |
CVE-2023-34038 | Medium | 5.3 | 2023-08-04 | VMware Horizon Server contains an information disclosure vulnerability. A malicious actor with network access may be able to access information relating to the… |
CVE-2023-34037 | Medium | 5.3 | 2023-08-04 | VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests. |
CVE-2023-20891 | Medium | 6.5 | 2023-07-26 | The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex enc… |
CVE-2023-34034 | Critical | 9.1 | 2023-07-19 | Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and t… |
CVE-2023-34035 | High | 7.3 | 2023-07-18 | Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the appl… |
CVE-2023-34036 | Medium | 5.3 | 2023-07-17 | Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind… |
CVE-2023-20899 | High | 7.5 | 2023-07-06 | VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VM… |
CVE-2023-25517 | High | 7.1 | 2023-07-04 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest OS may be able to control resources for which it is not… |
CVE-2023-20896 | Medium | 5.9 | 2023-06-22 | The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to v… |
CVE-2023-20895 | High | 8.1 | 2023-06-22 | The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCe… |
CVE-2023-20894 | High | 8.1 | 2023-06-22 | The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to… |
CVE-2023-20893 | High | 8.1 | 2023-06-22 | The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCente… |
CVE-2023-20892 | High | 8.1 | 2023-06-22 | The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious ac… |
CVE-2023-20867 | Low | 3.9 | 2023-06-13 | A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest… |
CVE-2023-20889 | High | 7.5 | 2023-06-07 | Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may… |
CVE-2023-20888 | High | 8.8 | 2023-06-07 | Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Netwo… |
CVE-2023-20887 | Critical | 9.8 | 2023-06-07 | Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be ab… |
CVE-2022-31693 | Medium | 5.5 | 2023-06-07 | VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with lo… |
CVE-2023-20884 | Medium | 6.1 | 2023-05-30 | VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect… |
CVE-2023-20883 | High | 7.5 | 2023-05-26 | In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-servic… |
CVE-2023-31131 | High | 7.4 | 2023-05-15 | Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extrac… |
CVE-2023-20880 | Medium | 6.7 | 2023-05-12 | VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges… |
CVE-2023-20879 | Medium | 6.7 | 2023-05-12 | VMware Aria Operations contains a Local privilege escalation vulnerability. A malicious actor with administrative privileges in the Aria Operations application… |
CVE-2023-20878 | High | 7.2 | 2023-05-12 | VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt th… |
CVE-2023-20877 | High | 8.8 | 2023-05-12 | VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leadi… |
CVE-2023-20870 | Medium | 6.0 | 2023-04-25 | VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual… |
CVE-2023-20869 | High | 8.2 | 2023-04-25 | VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Blueto… |
CVE-2023-20872 | High | 8.8 | 2023-04-25 | VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device emulation. |
CVE-2023-20871 | High | 7.8 | 2023-04-25 | VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system can elevate privileges… |
CVE-2023-29552 | High | 7.5 | 2023-04-25 | The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use s… |
CVE-2023-20873 | Critical | 9.8 | 2023-04-20 | In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to… |
CVE-2023-20865 | High | 7.2 | 2023-04-20 | VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs… |
CVE-2023-20864 | Critical | 9.8 | 2023-04-20 | VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for… |
CVE-2023-20862 | Medium | 6.3 | 2023-04-19 | In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean… |
CVE-2023-20866 | Medium | 6.5 | 2023-04-13 | In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have… |
CVE-2023-20863 | Medium | 6.5 | 2023-04-13 | In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may c… |
CVE-2023-0198 | Medium | 6.6 | 2023-04-01 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where improper restriction of operations within the bounds of a memory b… |
CVE-2023-0197 | Medium | 5.5 | 2023-04-01 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious user in a guest VM can cause a NULL-pointer dereference, which may… |
CVE-2023-0192 | Medium | 4.7 | 2023-04-01 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer handler, where improper privilege management can lead to escalation of… |
CVE-2023-0191 | High | 7.1 | 2023-04-01 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds access may lead to denial of… |
CVE-2023-0188 | Medium | 5.5 | 2023-04-01 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged user can cause improper restri… |
CVE-2023-0185 | Medium | 6.7 | 2023-04-01 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where sign conversion issuescasting an unsigned primitive to signed may… |