Overview 52 matches · 6 in Waratek scope · 4 protected · 0 exploited · 0 CISA KEV · 9 EPSS ≥ 0.5
Protected by Waratek
4
7.7%
Rule in development
0
0.0%
Mitigation candidate
2
3.8%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
46
88.5%
Withdrawn CVE
0
0.0%
blocked by ARMR today
4
7.7%
partly blocked
0
0.0%
not blocked
48
92.3%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
52
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 6 / year
19991
Not applicable1
High1
not blocked1
Working exploit published1
20000
20010
20021
Not applicable1
High1
not blocked1
Working exploit published1
20030
20040
20050
20062
Not applicable2
Medium2
not blocked2
Working exploit published2
20071
Not applicable1
Medium1
not blocked1
Working exploit published1
20082
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20094
Not applicable4
High1
Medium3
not blocked4
Working exploit published4
20106
Not applicable6
Critical2
High3
Medium1
not blocked6
Working exploit published6
20113
Not applicable3
High1
Medium2
not blocked3
Working exploit published3
20123
Mitigation candidate1
Not applicable2
High1
Medium2
not blocked3
Working exploit published3
20134
Protected by Waratek1
Not applicable3
High2
Medium2
blocked by ARMR today1
not blocked3
Working exploit published4
20140
20151
Not applicable1
High1
not blocked1
Working exploit published1
20164
Not applicable4
Critical1
High3
not blocked4
Working exploit published4
20175
Not applicable5
Critical2
High1
Medium2
not blocked5
Working exploit published5
20182
Protected by Waratek1
Not applicable1
High1
Medium1
blocked by ARMR today1
not blocked1
Working exploit published2
20192
Protected by Waratek1
Not applicable1
High1
Medium1
blocked by ARMR today1
not blocked1
Working exploit published2
20202
Protected by Waratek1
Not applicable1
High1
Medium1
blocked by ARMR today1
not blocked1
Working exploit published2
20211
Not applicable1
High1
not blocked1
Working exploit published1
20221
Not applicable1
High1
not blocked1
Working exploit published1
20235
Not applicable5
Critical2
High3
not blocked5
Working exploit published5
20241
Not applicable1
High1
not blocked1
Working exploit published1
20250
20261
Mitigation candidate1
High1
not blocked1
Working exploit published1
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-22739 | High | 2026-03-24 | Mitigation candidate | Working exploit published | Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2. |
| CVE-2024-37081 | High | 2024-06-18 | Not applicable | Working exploit published | The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance. |
| CVE-2022-22942 | High | 2023-12-13 | Not applicable | Working exploit published | The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer. |
| CVE-2023-34039 | Critical | 2023-08-29 | Not applicable | Working exploit published | Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI. |
| CVE-2023-20889 | High | 2023-06-07 | Not applicable | Working exploit published | Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in information disclosure. |
| CVE-2023-20888 | High | 2023-06-07 | Not applicable | Working exploit published | Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution. |
| CVE-2023-20864 | Critical | 2023-04-20 | Not applicable | Working exploit published | VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root. |
| CVE-2022-31660 | High | 2022-08-05 | Not applicable | Working exploit published | VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'. |
| CVE-2021-22015 | High | 2021-09-23 | Not applicable | Working exploit published | The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance. |
| CVE-2020-3956 | High | 2020-05-20 | Not applicable | Working exploit published | VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access. |
| CVE-2020-5405 | Medium | 2020-03-05 | Protected by Waratek | Working exploit published | Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack. |
| CVE-2019-3799 | Medium | 2019-05-06 | Protected by Waratek | Working exploit published | Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack. |
| CVE-2019-5512 | High | 2019-04-09 | Not applicable | Working exploit published | VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) running on Windows does not handle COM classes appropriately. Successful exploitation of this issue may allow hijacking of COM classes used by the VMX process, on a Windows host, leading to elevation of privilege. |
| CVE-2018-5511 | High | 2018-04-13 | Not applicable | Working exploit published | On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced. |
| CVE-2018-1271 | Medium | 2018-04-06 | Protected by Waratek | Working exploit published | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack. |
| CVE-2017-4901 | Critical | 2017-06-08 | Not applicable | Working exploit published | The drag-and-drop (DnD) function in VMware Workstation 12.x before version 12.5.4 and Fusion 8.x before version 8.5.5 has an out-of-bounds memory access vulnerability. This may allow a guest to execute code on the operating system that runs Workstation or Fusion. |
| CVE-2017-4914 | Critical | 2017-06-07 | Not applicable | Working exploit published | VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance. |
| CVE-2017-4905 | Medium | 2017-06-07 | Not applicable | Working exploit published | VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have uninitialized memory usage. This issue may lead to an information leak. |
| CVE-2017-4916 | Medium | 2017-05-22 | Not applicable | Working exploit published | VMware Workstation Pro/Player contains a NULL pointer dereference vulnerability that exists in the vstor2 driver. Successful exploitation of this issue may allow host users with normal user privileges to trigger a denial-of-service in a Windows host machine. |
| CVE-2017-4915 | High | 2017-05-22 | Not applicable | Working exploit published | VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of this issue may allow unprivileged host users to escalate their privileges to root in a Linux host machine. |
| CVE-2016-7456 | Critical | 2016-12-29 | Not applicable | Working exploit published | VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for remote attackers to obtain login access via an SSH session. |
| CVE-2016-7084 | High | 2016-12-29 | Not applicable | Working exploit published | tpview.dll in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado ThinPrint virtual printing is enabled, allows guest OS users to execute arbitrary code on the host OS or cause a denial of service (host OS memory corruption) via a JPEG 2000 image. |
| CVE-2016-7083 | High | 2016-12-29 | Not applicable | Working exploit published | VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado ThinPrint virtual printing is enabled, allow guest OS users to execute arbitrary code on the host OS or cause a denial of service (host OS memory corruption) via TrueType fonts embedded in EMFSPOOL. |
| CVE-2016-5330 | High | 2016-08-08 | Not applicable | Working exploit published | Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation Pro 12.1.x before 12.1.1, VMware Workstation Player 12.1.x before 12.1.1, and VMware Fusion 8.1.x before 8.1.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory. |
| CVE-2015-2342 | High | 2015-10-12 | Not applicable | Working exploit published | The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol. |
| CVE-2013-6366 | Medium | 2013-11-04 | Protected by Waratek | Working exploit published | The Groovy script console in VMware Hyperic HQ 4.6.6 allows remote authenticated administrators to execute arbitrary code via a Runtime.getRuntime().exec call. |
| CVE-2013-1662 | Medium | 2013-08-24 | Not applicable | Working exploit published | vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allows host OS users to gain host OS privileges via a crafted lsb_release binary in a directory in the PATH, related to use of the popen library function. |
| CVE-2013-3520 | High | 2013-06-17 | Not applicable | Working exploit published | VMware vCenter Chargeback Manager (aka CBM) before 2.5.1 does not proper handle uploads, which allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2013-1406 | High | 2013-02-11 | Not applicable | Working exploit published | The Virtual Machine Communication Interface (VMCI) implementation in vmci.sys in VMware Workstation 8.x before 8.0.5 and 9.x before 9.0.1 on Windows, VMware Fusion 4.1 before 4.1.4 and 5.0 before 5.0.2, VMware View 4.x before 4.6.2 and 5.x before 5.1.2 on Windows, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1 does not properly restrict memory allocation by control code, which allows local users to gain privileges via unspecified vectors. |
| CVE-2011-2732 | Medium | 2012-12-05 | Mitigation candidate | Working exploit published | CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter. |
| CVE-2012-3569 | High | 2012-11-14 | Not applicable | Working exploit published | Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0.5, and other products, allows user-assisted remote attackers to execute arbitrary code via a crafted OVF file. |
| CVE-2012-1666 | Medium | 2012-09-08 | Not applicable | Working exploit published | Untrusted search path vulnerability in VMware Tools in VMware Workstation before 8.0.4, VMware Player before 4.0.4, VMware Fusion before 4.1.2, VMware View before 5.1, and VMware ESX 4.1 before U3 and 5.0 before P03 allows local users to gain privileges via a Trojan horse tpfc.dll file in the current working directory. |
| CVE-2011-4404 | Medium | 2011-11-19 | Not applicable | Working exploit published | The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to CVE-2009-1523. |
| CVE-2011-2217 | High | 2011-06-06 | Not applicable | Working exploit published | Certain ActiveX controls in (1) tsgetxu71ex552.dll and (2) tsgetx71ex552.dll in Tom Sawyer GET Extension Factory 5.5.2.237, as used in VI Client (aka VMware Infrastructure Client) 2.0.2 before Build 230598 and 2.5 before Build 204931 in VMware Infrastructure 3, do not properly handle attempted initialization within Internet Explorer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HTML document. |
| CVE-2010-3609 | Medium | 2011-03-11 | Not applicable | Working exploit published | The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information. |
| CVE-2010-4297 | High | 2010-12-06 | Not applicable | Working exploit published | The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player 2.5.x before 2.5.5 build 328052 and 3.1.x before 3.1.2 build 301548; VMware Server 2.0.2; VMware Fusion 2.x before 2.0.8 build 328035 and 3.1.x before 3.1.2 build 332101; VMware ESXi 3.5, 4.0, and 4.1; and VMware ESX 3.0.3, 3.5, 4.0, and 4.1 allows host OS users to gain privileges on the guest OS via unspecified vectors, related to a "command injection" issue. |
| CVE-2010-2943 | High | 2010-09-30 | Not applicable | Working exploit published | The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle. |
| CVE-2010-0211 | Critical | 2010-07-28 | Not applicable | Working exploit published | The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences, which triggers a free of an invalid, uninitialized pointer in the slap_mods_free function, as demonstrated using the Codenomicon LDAPv3 test suite. |
| CVE-2010-1205 | Critical | 2010-06-30 | Not applicable | Working exploit published | Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row. |
| CVE-2010-1143 | Medium | 2010-05-07 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in VMware View (formerly Virtual Desktop Manager or VDM) 3.1.x before 3.1.3 build 252693 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2009-3732 | High | 2010-04-12 | Not applicable | Working exploit published | Format string vulnerability in vmware-vmrc.exe build 158248 in VMware Remote Console (aka VMrc) allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2009-3621 | Medium | 2009-10-22 | Not applicable | Working exploit published | net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket. |
| CVE-2009-3707 | Medium | 2009-10-16 | Not applicable | Working exploit published | VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459, VMware Player 3.0 before 3.0.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, and VMware Server 2.x allows remote attackers to cause a denial of service (process crash) via a \x25\xFF sequence in the USER and PASS commands, related to a "format string DoS" issue. NOTE: some of these details are obtained from third party information. |
| CVE-2009-3281 | High | 2009-10-16 | Not applicable | Working exploit published | The vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 does not use correct file permissions, which allows host OS users to gain privileges on the host OS via unspecified vectors. |
| CVE-2009-0177 | Medium | 2009-01-20 | Not applicable | Working exploit published | vmwarebase.dll, as used in the vmware-authd service (aka vmware-authd.exe), in VMware Workstation 6.5.1 build 126130, 6.5.1 and earlier; VMware Player 2.5.1 build 126130, 2.5.1 and earlier; VMware ACE 2.5.1 and earlier; VMware Server 2.0.x before 2.0.1 build 156745; and VMware Fusion before 2.0.2 build 147997 allows remote attackers to cause a denial of service (daemon crash) via a long (1) USER or (2) PASS command. |
| CVE-2008-3892 | High | 2008-09-03 | Not applicable | Working exploit published | Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a call to the GuestInfo method in which there is a long string argument, and an assignment of a long string value to the result of this call. NOTE: this may overlap CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, or CVE-2008-3696. |
| CVE-2008-3761 | Medium | 2008-08-21 | Not applicable | Working exploit published | hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 uses the METHOD_NEITHER communication method for IOCTLs, which allows local users to cause a denial of service via a crafted IOCTL request. |
| CVE-2007-4059 | Medium | 2007-07-30 | Not applicable | Working exploit published | Absolute path traversal vulnerability in a certain ActiveX control in IntraProcessLogging.dll 5.5.3.42958 in EMC VMware allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the SetLogFileName method. |
| CVE-2006-6410 | Medium | 2006-12-10 | Not applicable | Working exploit published | Buffer overflow in an ActiveX control in VMWare 5.5.1 allows local users to execute arbitrary code via a long VmdbDb parameter to the Initialize function. |
| CVE-2006-2481 | Medium | 2006-07-31 | Not applicable | Working exploit published | VMware ESX Server 2.0.x before 2.0.2 and 2.x before 2.5.2 patch 4 stores authentication credentials in base 64 encoded format in the vmware.mui.kid and vmware.mui.sid cookies, which allows attackers to gain privileges by obtaining the cookies using attacks such as cross-site scripting (CVE-2005-3619). |
| CVE-2002-0814 | High | 2002-08-12 | Not applicable | Working exploit published | Buffer overflow in VMware Authorization Service for VMware GSX Server 2.0.0 build-2050 allows remote authenticated users to execute arbitrary code via a long GLOBAL argument. |
| CVE-1999-0733 | High | 1999-06-26 | Not applicable | Working exploit published | Buffer overflow in VMWare 1.0.1 for Linux via a long HOME environmental variable. |