VMware
Page 4 of 12 — VMware CVEs from a corpus of 1172, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-22250 | High | 7.8 | 2024-02-20 | Session Hijack vulnerability in Deprecated VMware Enhanced Authentication Plug-in could allow a malicious actor with unprivileged local access to a windows ope… |
CVE-2024-22245 | Critical | 9.6 | 2024-02-20 | Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor… |
CVE-2024-22234 | High | 7.4 | 2024-02-20 | In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly use… |
CVE-2024-22241 | Medium | 4.3 | 2024-02-06 | Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious payload into the log… |
CVE-2024-22240 | Medium | 4.9 | 2024-02-06 | Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerability leading to unauth… |
CVE-2024-22239 | Medium | 5.3 | 2024-02-06 | Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this v… |
CVE-2024-22238 | Medium | 6.4 | 2024-02-06 | Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may be able to inject malicious code into u… |
CVE-2024-22237 | High | 7.8 | 2024-02-06 | Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this v… |
CVE-2023-34042 | Medium | 4.1 | 2024-02-05 | The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with… |
CVE-2024-22236 | Low | 3.3 | 2024-01-31 | In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to loc… |
CVE-2024-22233 | High | 7.5 | 2024-01-22 | In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) co… |
CVE-2023-34063 | Critical | 9.9 | 2024-01-16 | Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized acc… |
CVE-2022-22942 | High | 7.8 | 2023-12-13 | The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the s… |
CVE-2023-34064 | Medium | 4.6 | 2023-12-12 | Workspace ONE Launcher contains a Privilege Escalation Vulnerability. A malicious actor with physical access to Workspace ONE Launcher could utilize the Edge P… |
CVE-2023-34055 | Medium | 5.3 | 2023-11-28 | In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a den… |
CVE-2023-34053 | Medium | 5.3 | 2023-11-28 | In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) cond… |
CVE-2023-34060 | Critical | 9.8 | 2023-11-14 | VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from an older vers… |
CVE-2023-31026 | Medium | 6.0 | 2023-11-02 | NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a NULL-pointer dereference may lead to deni… |
CVE-2023-31022 | Medium | 5.5 | 2023-11-02 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a NULL-pointer dereference may lead to denial of servi… |
CVE-2023-31021 | Medium | 5.5 | 2023-11-02 | NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a malicious user in the guest VM can cause… |
CVE-2023-31018 | Medium | 6.5 | 2023-11-02 | NVIDIA GPU Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a NULL-pointer derefere… |
CVE-2023-20886 | High | 8.8 | 2023-10-31 | VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve thei… |
CVE-2023-34059 | High | 7.4 | 2023-10-27 | open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack… |
CVE-2023-34058 | High | 7.1 | 2023-10-27 | VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/… |
CVE-2023-34057 | High | 7.8 | 2023-10-27 | VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may elevate privileges wi… |
CVE-2023-46120 | Medium | 4.9 | 2023-10-25 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when recei… |
CVE-2023-46118 | Medium | 4.9 | 2023-10-25 | RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (D… |
CVE-2023-44794 | Critical | 9.8 | 2023-10-25 | An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL. |
CVE-2023-34056 | Medium | 4.3 | 2023-10-25 | vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage thi… |
CVE-2023-34048 | Critical | 9.8 | 2023-10-25 | vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Ser… |
CVE-2023-34045 | Medium | 6.6 | 2023-10-20 | VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to dr… |
CVE-2023-34046 | Medium | 6.7 | 2023-10-20 | VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during installation for the first time (the user ne… |
CVE-2023-34044 | High | 7.1 | 2023-10-20 | VMware Workstation( 17.x prior to 17.5) and Fusion(13.x prior to 13.5) contain an out-of-bounds read vulnerability that exists in the functionality for sharin… |
CVE-2023-34052 | High | 7.8 | 2023-10-20 | VMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with non-administrative access to the local system can trigger the… |
CVE-2023-34051 | Critical | 9.8 | 2023-10-20 | VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system… |
CVE-2023-34050 | Medium | 5.0 | 2023-10-19 | In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing… |
CVE-2023-34043 | Medium | 6.7 | 2023-09-27 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privi… |
CVE-2023-34047 | Low | 3.1 | 2023-09-20 | A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security contex… |
CVE-2023-20900 | High | 7.1 | 2023-08-31 | A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A… |
CVE-2023-34039 | Critical | 9.8 | 2023-08-29 | Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with netwo… |
CVE-2023-20890 | High | 7.2 | 2023-08-29 | Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to VMware Aria Operati… |
CVE-2023-34040 | Medium | 5.3 | 2023-08-24 | In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configurati… |
CVE-2023-34038 | Medium | 5.3 | 2023-08-04 | VMware Horizon Server contains an information disclosure vulnerability. A malicious actor with network access may be able to access information relating to the… |
CVE-2023-34037 | Medium | 5.3 | 2023-08-04 | VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests. |
CVE-2023-20891 | Medium | 6.5 | 2023-07-26 | The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex enc… |
CVE-2023-34034 | Critical | 9.1 | 2023-07-19 | Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and t… |
CVE-2023-34035 | High | 7.3 | 2023-07-18 | Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the appl… |
CVE-2023-34036 | Medium | 5.3 | 2023-07-17 | Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind… |
CVE-2023-20899 | High | 7.5 | 2023-07-06 | VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VM… |
CVE-2023-25517 | High | 7.1 | 2023-07-04 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest OS may be able to control resources for which it is not… |
CVE-2023-20896 | Medium | 5.9 | 2023-06-22 | The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to v… |
CVE-2023-20895 | High | 8.1 | 2023-06-22 | The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCe… |
CVE-2023-20894 | High | 8.1 | 2023-06-22 | The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to… |
CVE-2023-20893 | High | 8.1 | 2023-06-22 | The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCente… |
CVE-2023-20892 | High | 8.1 | 2023-06-22 | The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious ac… |
CVE-2023-20867 | Low | 3.9 | 2023-06-13 | A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest… |
CVE-2023-20889 | High | 7.5 | 2023-06-07 | Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may… |
CVE-2023-20888 | High | 8.8 | 2023-06-07 | Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Netwo… |
CVE-2023-20887 | Critical | 9.8 | 2023-06-07 | Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be ab… |
CVE-2022-31693 | Medium | 5.5 | 2023-06-07 | VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with lo… |
CVE-2023-20884 | Medium | 6.1 | 2023-05-30 | VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect… |
CVE-2023-20883 | High | 7.5 | 2023-05-26 | In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-servic… |
CVE-2023-31131 | High | 7.4 | 2023-05-15 | Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extrac… |
CVE-2023-20880 | Medium | 6.7 | 2023-05-12 | VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges… |
CVE-2023-20879 | Medium | 6.7 | 2023-05-12 | VMware Aria Operations contains a Local privilege escalation vulnerability. A malicious actor with administrative privileges in the Aria Operations application… |
CVE-2023-20878 | High | 7.2 | 2023-05-12 | VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt th… |
CVE-2023-20877 | High | 8.8 | 2023-05-12 | VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leadi… |
CVE-2023-20870 | Medium | 6.0 | 2023-04-25 | VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual… |
CVE-2023-20869 | High | 8.2 | 2023-04-25 | VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Blueto… |
CVE-2023-20872 | High | 8.8 | 2023-04-25 | VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device emulation. |
CVE-2023-20871 | High | 7.8 | 2023-04-25 | VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system can elevate privileges… |
CVE-2023-29552 | High | 7.5 | 2023-04-25 | The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use s… |
CVE-2023-20873 | Critical | 9.8 | 2023-04-20 | In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to… |
CVE-2023-20865 | High | 7.2 | 2023-04-20 | VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs… |
CVE-2023-20864 | Critical | 9.8 | 2023-04-20 | VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for… |
CVE-2023-20862 | Medium | 6.3 | 2023-04-19 | In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean… |
CVE-2023-20866 | Medium | 6.5 | 2023-04-13 | In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have… |
CVE-2023-20863 | Medium | 6.5 | 2023-04-13 | In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may c… |
CVE-2023-0198 | Medium | 6.6 | 2023-04-01 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where improper restriction of operations within the bounds of a memory b… |
CVE-2023-0197 | Medium | 5.5 | 2023-04-01 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious user in a guest VM can cause a NULL-pointer dereference, which may… |
CVE-2023-0192 | Medium | 4.7 | 2023-04-01 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer handler, where improper privilege management can lead to escalation of… |
CVE-2023-0191 | High | 7.1 | 2023-04-01 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds access may lead to denial of… |
CVE-2023-0188 | Medium | 5.5 | 2023-04-01 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged user can cause improper restri… |
CVE-2023-0185 | Medium | 6.7 | 2023-04-01 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where sign conversion issuescasting an unsigned primitive to signed may… |
CVE-2023-0183 | High | 7.1 | 2023-04-01 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an out-of-bounds write can lead to denial of service and data tampe… |
CVE-2023-0181 | High | 7.1 | 2023-04-01 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a kernel mode layer handler, where memory permissions are not correctly checked, wh… |
CVE-2023-0180 | High | 7.1 | 2023-04-01 | NVIDIA GPU Display Driver for Linux contains a vulnerability in a kernel mode layer handler, which may lead to denial of service or information disclosure. |
CVE-2023-20860 | High | 7.5 | 2023-03-27 | Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a… |
CVE-2023-20861 | Medium | 6.5 | 2023-03-23 | In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provid… |
CVE-2023-20859 | Medium | 5.5 | 2023-03-23 | In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive inf… |
CVE-2023-20857 | Medium | 6.8 | 2023-02-28 | VMware Workspace ONE Content contains a passcode bypass vulnerability. A malicious actor, with access to a users rooted device, may be able to bypass the VMwar… |
CVE-2023-20858 | High | 7.2 | 2023-02-22 | VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with… |
CVE-2023-20855 | High | 8.8 | 2023-02-22 | VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, m… |
CVE-2022-36797 | Low | 3.3 | 2023-02-16 | Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenticated user to poten… |
CVE-2022-36416 | Medium | 4.4 | 2023-02-16 | Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.13 may allow an authenticated user to pote… |
CVE-2023-20854 | High | 8.4 | 2023-02-03 | VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim's machine may exploit this vul… |
CVE-2023-20856 | High | 8.8 | 2023-02-01 | VMware vRealize Operations (vROps) contains a CSRF bypass vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenti… |
CVE-2022-31711 | Medium | 5.3 | 2023-01-26 | VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and application informat… |
CVE-2022-31710 | High | 7.5 | 2023-01-26 | vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization of untrusted data wh… |
CVE-2022-31706 | Critical | 9.8 | 2023-01-26 | The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an imp… |