Vmware
Page 5 of 7 — Vmware CVEs from a corpus of 615, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22978 | Critical | 9.8 | 2022-05-19 | In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on… |
CVE-2022-22976 | Medium | 5.3 | 2022-05-19 | Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the… |
CVE-2022-22971 | Medium | 6.5 | 2022-05-12 | In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denia… |
CVE-2022-22970 | Medium | 5.3 | 2022-05-12 | In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if the… |
CVE-2022-22975 | Medium | 6.6 | 2022-05-11 | An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the m… |
CVE-2022-22968 | Medium | 5.3 | 2022-04-14 | In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensiti… |
CVE-2022-22966 | High | 7.2 | 2022-04-14 | An authenticated, high privileged malicious actor with network access to the VMware Cloud Director tenant or provider may be able to exploit a remote code exec… |
CVE-2022-22961 | Medium | 5.3 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A ma… |
CVE-2022-22960 | High | 7.8 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scrip… |
CVE-2022-22959 | Medium | 4.3 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user th… |
CVE-2022-22958 | High | 7.2 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A ma… |
CVE-2022-22957 | High | 7.2 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A ma… |
CVE-2022-22956 | Critical | 9.8 | 2022-04-13 | VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may… |
CVE-2022-22955 | Critical | 9.8 | 2022-04-13 | VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may… |
CVE-2022-22964 | High | 7.8 | 2022-04-11 | VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation that allows a user to escalate to root due to a vulnerable configuration f… |
CVE-2022-22962 | High | 7.8 | 2022-04-11 | VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation as a user is able to change the default shared folder location due to a vu… |
CVE-2022-22954 | Critical | 9.8 | 2022-04-11 | VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with ne… |
CVE-2021-22055 | Medium | 5.3 | 2022-04-11 | The SchedulerServer in Vmware photon allows remote attackers to inject logs through \r in the package parameter. Attackers can also insert malicious data and f… |
CVE-2022-22965 | Critical | 9.8 | 2022-04-01 | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires t… |
CVE-2022-22963 | Critical | 9.8 | 2022-04-01 | In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a speciall… |
CVE-2022-22950 | Medium | 6.5 | 2022-04-01 | n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may ca… |
CVE-2022-27772 | High | 7.8 | 2022-03-30 | spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot… |
CVE-2022-22948 | Medium | 6.5 | 2022-03-29 | The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to th… |
CVE-2022-22952 | Critical | 9.1 | 2022-03-23 | VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file upload vulnerabili… |
CVE-2022-22951 | Critical | 9.1 | 2022-03-23 | VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection v… |
CVE-2022-22946 | Medium | 5.5 | 2022-03-04 | In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be co… |
CVE-2022-22947 | Critical | 10.0 | 2022-03-03 | In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enab… |
CVE-2022-22943 | Medium | 6.7 | 2022-03-03 | VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability. A malicious actor with local administrative pr… |
CVE-2022-22944 | Medium | 5.4 | 2022-03-02 | VMware Workspace ONE Boxer contains a stored cross-site scripting (XSS) vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE… |
CVE-2022-22945 | High | 7.8 | 2022-02-16 | VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the… |
CVE-2021-22050 | High | 7.5 | 2022-02-16 | ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. A malicious actor with network access to ESXi may exploit this issue to create a… |
CVE-2021-22043 | High | 7.5 | 2022-02-16 | VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled. A malicious actor with access to se… |
CVE-2021-22042 | High | 7.8 | 2022-02-16 | VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within… |
CVE-2021-22041 | Medium | 6.7 | 2022-02-16 | VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on… |
CVE-2021-22040 | Medium | 6.7 | 2022-02-16 | VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges… |
CVE-2022-22939 | Medium | 4.9 | 2022-02-04 | VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Mana… |
CVE-2022-22938 | Medium | 6.5 | 2022-01-28 | VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPri… |
CVE-2021-22060 | Medium | 4.3 | 2022-01-10 | In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the… |
CVE-2021-22045 | High | 7.8 | 2022-01-04 | VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-… |
CVE-2021-22057 | High | 8.8 | 2021-12-20 | VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 contain an authentication bypass vulnerability. A malicious actor, who has successfully provided first-… |
CVE-2021-22056 | High | 7.5 | 2021-12-20 | VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability. A malicious actor with netw… |
CVE-2021-22054 | High | 7.5 | 2021-12-17 | VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SS… |
CVE-2021-22095 | Medium | 6.5 | 2021-11-30 | In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the m… |
CVE-2021-22049 | Critical | 9.8 | 2021-11-24 | The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. A malicious actor wi… |
CVE-2021-21980 | High | 7.5 | 2021-11-24 | The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. A malicious actor with network access to port 443 on vCenter Se… |
CVE-2021-22053 | High | 8.8 | 2021-11-19 | Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request… |
CVE-2021-22048 | High | 8.8 | 2021-11-10 | The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A malicious actor wit… |
CVE-2021-22051 | Medium | 6.5 | 2021-11-08 | Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affec… |
CVE-2021-22038 | High | 8.8 | 2021-10-29 | On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller exits, so it does not… |
CVE-2021-22037 | High | 7.8 | 2021-10-29 | Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforc… |
CVE-2021-22097 | Medium | 6.5 | 2021-10-28 | In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with… |
CVE-2021-22096 | Medium | 4.3 | 2021-10-28 | In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the… |
CVE-2021-22047 | Medium | 5.3 | 2021-10-28 | In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured… |
CVE-2021-22044 | High | 7.5 | 2021-10-28 | In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level `@RequestMapping`annota… |
CVE-2021-22034 | High | 7.5 | 2021-10-21 | Releases prior to VMware vRealize Operations Tenant App 8.6 contain an Information Disclosure Vulnerability. |
CVE-2021-22036 | Medium | 6.5 | 2021-10-13 | VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor may be able to redire… |
CVE-2021-22035 | Medium | 4.3 | 2021-10-13 | VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export function. An authe… |
CVE-2021-22033 | Low | 2.7 | 2021-10-13 | Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery (SSRF) vulnerability. |
CVE-2021-22020 | Medium | 5.5 | 2021-09-23 | The vCenter Server contains a denial-of-service vulnerability in the Analytics service. Successful exploitation of this issue may allow an attacker to create a… |
CVE-2021-22019 | High | 7.5 | 2021-09-23 | The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 5480 on vCenter Serv… |
CVE-2021-22018 | Medium | 6.5 | 2021-09-23 | The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A malicious actor with network access to p… |
CVE-2021-22017 | Medium | 5.3 | 2021-09-23 | Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port… |
CVE-2021-22016 | Medium | 6.1 | 2021-09-23 | The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit this issue to execute m… |
CVE-2021-22015 | High | 7.8 | 2021-09-23 | The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local us… |
CVE-2021-22014 | High | 7.2 | 2021-09-23 | The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). An authenticated VAMI user wit… |
CVE-2021-22013 | High | 7.5 | 2021-09-23 | The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicious actor with netwo… |
CVE-2021-22012 | High | 7.5 | 2021-09-23 | The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access t… |
CVE-2021-22011 | Medium | 5.3 | 2021-09-23 | vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious actor with network access to port 443 on v… |
CVE-2021-22010 | High | 7.5 | 2021-09-23 | The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter Server may exploit… |
CVE-2021-22009 | High | 7.5 | 2021-09-23 | The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCen… |
CVE-2021-22008 | High | 7.5 | 2021-09-23 | The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter… |
CVE-2021-22007 | Medium | 5.5 | 2021-09-23 | The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administrative privilege may… |
CVE-2021-22006 | High | 7.5 | 2021-09-23 | The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. A malicious actor with network access to port 443… |
CVE-2021-22005 | Critical | 9.8 | 2021-09-23 | The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Serve… |
CVE-2021-21993 | Medium | 6.5 | 2021-09-23 | The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content Library. An author… |
CVE-2021-21992 | Medium | 6.5 | 2021-09-22 | The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing. A malicious actor with non-administrative user access to the… |
CVE-2021-21991 | High | 7.8 | 2021-09-22 | The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens. A malicious actor with non-administrative user… |
CVE-2020-3960 | High | 8.4 | 2021-09-15 | VMware ESXi (6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain an… |
CVE-2021-22003 | High | 7.5 | 2021-08-31 | VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 ma… |
CVE-2021-22002 | Critical | 9.8 | 2021-08-31 | VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom hos… |
CVE-2021-22029 | High | 7.5 | 2021-08-31 | VMware Workspace ONE UEM REST API contains a denial of service vulnerability. A malicious actor with access to /API/system/admins/session could cause an API de… |
CVE-2021-22021 | Medium | 5.4 | 2021-08-30 | VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. An attacker with user… |
CVE-2021-22027 | High | 7.5 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network… |
CVE-2021-22026 | High | 7.5 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network… |
CVE-2021-22025 | High | 7.5 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access. An unauthenticated… |
CVE-2021-22024 | High | 7.5 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network acces… |
CVE-2021-22023 | High | 7.2 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) has insecure object reference vulnerability. A malicious actor with administrative access to vRealize Op… |
CVE-2021-22022 | Medium | 4.9 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read vulnerability. A malicious actor with administrative access to vRealize… |
CVE-2021-22000 | High | 7.8 | 2021-07-13 | VMware Thinapp version 5.x prior to 5.2.10 contain a DLL hijacking vulnerability due to insecure loading of DLLs. A malicious actor with non-administrative pri… |
CVE-2021-21995 | High | 7.5 | 2021-07-13 | OpenSLP as used in ESXi has a denial-of-service vulnerability due a heap out-of-bounds read issue. A malicious actor with network access to port 427 on ESXi ma… |
CVE-2021-21994 | Critical | 9.8 | 2021-07-13 | SFCB (Small Footprint CIM Broker) as used in ESXi has an authentication bypass vulnerability. A malicious actor with network access to port 5989 on ESXi may ex… |
CVE-2021-22119 | High | 7.5 | 2021-06-29 | Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (Do… |
CVE-2021-32719 | Low | 3.1 | 2021-06-28 | RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI v… |
CVE-2021-32718 | Low | 3.1 | 2021-06-28 | RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's ba… |
CVE-2021-21999 | High | 7.8 | 2021-06-23 | VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware App Volumes (2.x prior to 2.18.10 and 4 pr… |
CVE-2021-21998 | Critical | 9.8 | 2021-06-23 | VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the… |
CVE-2021-21997 | Medium | 5.5 | 2021-06-18 | VMware Tools for Windows (11.x.y prior to 11.3.0) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges… |
CVE-2021-22116 | High | 7.5 | 2021-06-08 | RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A… |
CVE-2021-22118 | High | 7.8 | 2021-05-27 | In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)cr… |
CVE-2021-21986 | Critical | 9.8 | 2021-05-26 | The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Ma… |