WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor vmware✕
Overview 1,045 matches · 292 in Waratek scope · 65 protected · 73 exploited · 41 CISA KEV · 118 public PoC · 47 EPSS ≥ 0.5
1,045matches 292in Waratek scope27.9% 65protected6.2% 73exploited7.0% 41CISA KEV3.9% 118public PoC11.3% 47EPSS ≥ 0.54.5%
Protected by Waratek 65 6.2% Rule in development 0 0.0% Mitigation candidate 9 0.9% No exploit published 218 20.9% Outside Waratek scope 5 0.5% Not applicable 748 71.6% Withdrawn CVE 0 0.0%
Critical 132 12.6% High 447 42.8% Medium 421 40.3% Low 45 4.3% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 65 6.2% partly blocked 0 0.0% not blocked 980 93.8% not established 0 0.0% unrecorded 0 0.0%
Exploited 73 7.0% Working exploit published 52 5.0% Proof of concept only 25 2.4% Forecast only 3 0.3% No public exploit 892 85.4%
split by peak 184 / year
Not applicable: 748Outside Waratek scope: 5No exploit published: 218Mitigation candidate: 9Protected by Waratek: 65 Low: 45Medium: 421High: 447Critical: 132 not blocked: 980blocked by ARMR today: 65 No public exploit: 892Forecast only: 3Proof of concept only: 25Working exploit published: 52Exploited: 73
19991 Not applicable1 High1 not blocked1 Working exploit published1 20001 Not applicable1 Low1 not blocked1 No public exploit1 20011 Not applicable1 Low1 not blocked1 No public exploit1 20021 Not applicable1 High1 not blocked1 Working exploit published1 20034 Not applicable4 High2 Medium1 Low1 not blocked4 No public exploit4 20044 Not applicable4 High2 Medium2 not blocked4 No public exploit4 20058 Not applicable8 High3 Medium4 Low1 not blocked8 No public exploit8 20066 Not applicable6 Medium5 Low1 not blocked6 Working exploit published2 No public exploit4 200725 Not applicable25 High13 Medium9 Low3 not blocked25 Working exploit published1 No public exploit24 200832 Not applicable32 High18 Medium12 Low2 not blocked32 Working exploit published2 No public exploit30 200930 Not applicable30 High11 Medium18 Low1 not blocked30 Exploited4 Working exploit published4 No public exploit22 201037 No exploit published2 Not applicable35 Critical2 High17 Medium17 Low1 not blocked37 Exploited2 Working exploit published6 No public exploit29 201122 Protected by Waratek1 No exploit published1 Not applicable20 High7 Medium11 Low4 blocked by ARMR today1 not blocked21 Working exploit published3 Proof of concept only1 No public exploit18 201234 Mitigation candidate1 No exploit published2 Outside Waratek scope1 Not applicable30 Critical1 High15 Medium17 Low1 not blocked34 Working exploit published3 No public exploit31 201318 Protected by Waratek1 Not applicable17 High12 Medium6 blocked by ARMR today1 not blocked17 Working exploit published4 No public exploit14 201424 Protected by Waratek5 No exploit published1 Not applicable18 Critical2 High3 Medium18 Low1 blocked by ARMR today5 not blocked19 Exploited2 Proof of concept only1 Forecast only2 No public exploit19 201516 Protected by Waratek1 Not applicable15 High4 Medium10 Low2 blocked by ARMR today1 not blocked15 Working exploit published1 No public exploit15 201638 Protected by Waratek2 Not applicable36 Critical6 High16 Medium16 blocked by ARMR today2 not blocked36 Working exploit published4 No public exploit34 201762 Protected by Waratek2 No exploit published7 Not applicable53 Critical10 High33 Medium18 Low1 blocked by ARMR today2 not blocked60 Working exploit published5 No public exploit57 201862 Protected by Waratek10 No exploit published9 Outside Waratek scope2 Not applicable41 Critical9 High30 Medium23 blocked by ARMR today10 not blocked52 Exploited5 Working exploit published2 Proof of concept only1 Forecast only1 No public exploit53 201938 Protected by Waratek2 No exploit published2 Not applicable34 Critical5 High17 Medium16 blocked by ARMR today2 not blocked36 Exploited3 Working exploit published2 No public exploit33 202080 Protected by Waratek4 Mitigation candidate1 No exploit published3 Outside Waratek scope1 Not applicable71 Critical11 High30 Medium33 Low6 blocked by ARMR today4 not blocked76 Exploited9 Working exploit published2 Proof of concept only2 No public exploit67 202181 Protected by Waratek7 Mitigation candidate1 No exploit published7 Not applicable66 Critical13 High38 Medium29 Low1 blocked by ARMR today7 not blocked74 Exploited12 Working exploit published1 No public exploit68 2022101 Protected by Waratek6 Mitigation candidate4 No exploit published10 Not applicable81 Critical25 High35 Medium39 Low2 blocked by ARMR today6 not blocked95 Exploited12 Working exploit published1 Proof of concept only4 No public exploit84 202375 Protected by Waratek2 No exploit published16 Not applicable57 Critical15 High35 Medium24 Low1 blocked by ARMR today2 not blocked73 Exploited8 Working exploit published5 Proof of concept only11 No public exploit51 202446 Protected by Waratek4 No exploit published5 Not applicable37 Critical9 High21 Medium16 blocked by ARMR today4 not blocked42 Exploited8 Working exploit published1 Proof of concept only2 No public exploit35 202514 Not applicable14 Critical2 High8 Medium4 not blocked14 Exploited4 No public exploit10 2026184 Protected by Waratek18 Mitigation candidate2 No exploit published153 Outside Waratek scope1 Not applicable10 Critical22 High75 Medium73 Low14 blocked by ARMR today18 not blocked166 Exploited4 Working exploit published1 Proof of concept only3 No public exploit176
1999200220052008201120142017202020232026
1,045 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 11 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2024-38832 High 2024-11-26 Not applicable No public exploit VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations.
CVE-2024-38831 High 2024-11-26 Not applicable No public exploit VMware Aria Operations contains a local privilege escalation vulnerability.  A malicious actor with local administrative privileges can insert malicious commands into the properties file to escalate privileges to  a root user on the appliance running VMware Aria Operations.
CVE-2024-38830 High 2024-11-26 Not applicable No public exploit VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this vulnerability to escalate privileges to root user on the appliance running VMware Aria Operations.
CVE-2024-38820 Medium 2024-10-18 No exploit published No public exploit The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
CVE-2024-38814 High 2024-10-16 Not applicable No public exploit An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. A malicious authenticated user with non-administrator privileges may be able to enter specially crafted SQL queries and perform unauthorized remote code execution on the HCX manager.  Updates are available to remediate this vulnerability in affected VMware products.
CVE-2024-38813 Critical 2024-09-17 Not applicable Exploited The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.
CVE-2024-38812 Critical 2024-09-17 Not applicable Exploited The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
CVE-2024-38811 High 2024-09-03 Not applicable No public exploit VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious actor with standard user privileges may exploit this vulnerability to execute code in the context of the Fusion application.
CVE-2024-38810 High 2024-08-20 No exploit published No public exploit Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.
CVE-2024-38808 Medium 2024-08-20 Protected by Waratek No public exploit In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.
CVE-2024-37084 Critical 2024-07-25 Protected by Waratek No public exploit In Spring Cloud Data Flow versions prior to 2.11.4,  a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server
CVE-2024-22280 High 2024-07-11 Not applicable No public exploit VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter specially crafted SQL queries and perform unauthorised read/write operations in the database.
CVE-2024-22277 Medium 2024-07-04 Not applicable No public exploit VMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor with network access to VMware Cloud Director Availability can craft malicious HTML tags to execute within replication tasks.
CVE-2024-37087 Medium 2024-06-25 Not applicable No public exploit The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition.
CVE-2024-37086 Medium 2024-06-25 Not applicable No public exploit VMware ESXi contains an out-of-bounds read vulnerability. A malicious actor with local administrative privileges on a virtual machine with an existing snapshot may trigger an out-of-bounds read leading to a denial-of-service condition of the host.
CVE-2024-37085 High 2024-06-25 Not applicable Exploited VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
CVE-2024-37081 High 2024-06-18 Not applicable Working exploit published The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.
CVE-2024-37080 Critical 2024-06-18 Not applicable Proof of concept only vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
CVE-2024-37079 Critical 2024-06-18 Not applicable Exploited vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
CVE-2024-22275 Medium 2024-05-21 Not applicable No public exploit The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially read arbitrary files containing sensitive data.
CVE-2024-22274 High 2024-05-21 Not applicable Proof of concept only The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system.
CVE-2024-22273 High 2024-05-21 Not applicable No public exploit The storage controllers on VMware ESXi, Workstation, and Fusion have out-of-bounds read/write vulnerability. A malicious actor with access to a virtual machine with storage controllers enabled may exploit this issue to create a denial of service condition or execute code on the hypervisor from a virtual machine in conjunction with other issues.
CVE-2024-22270 High 2024-05-14 Not applicable No public exploit VMware Workstation and Fusion contain an information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.
CVE-2024-22269 High 2024-05-14 Not applicable No public exploit VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.
CVE-2024-22268 High 2024-05-14 Not applicable No public exploit VMware Workstation and Fusion contain a heap buffer-overflow vulnerability in the Shader functionality. A malicious actor with non-administrative access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to create a denial of service condition.
CVE-2024-22267 Critical 2024-05-14 Not applicable No public exploit VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
CVE-2024-22259 High 2024-03-16 Protected by Waratek No public exploit Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
CVE-2024-22256 Medium 2024-03-07 Not applicable No public exploit VMware Cloud Director contains a partial information disclosure vulnerability. A malicious actor can potentially gather information about organization names based on the behavior of the instance.
CVE-2024-22255 High 2024-03-05 Not applicable Exploited VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process.  
CVE-2024-22254 High 2024-03-05 Not applicable Exploited VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox.
CVE-2024-22253 Critical 2024-03-05 Not applicable Exploited VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
CVE-2024-22252 Critical 2024-03-05 Not applicable Exploited VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
CVE-2024-22251 Medium 2024-02-29 Not applicable No public exploit VMware Workstation and Fusion contain an out-of-bounds read vulnerability in the USB CCID (chip card interface device). A malicious actor with local administrative privileges on a virtual machine may trigger an out-of-bounds read leading to information disclosure.
CVE-2024-22235 Medium 2024-02-21 Not applicable No public exploit VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'.
CVE-2024-22234 High 2024-02-20 No exploit published No public exploit In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method. Specifically, an application is vulnerable if: * The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value. An application is not vulnerable if any of the following is true: * The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly. * The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated * The application only uses isFullyAuthenticated via Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html  or HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html
CVE-2024-22241 Medium 2024-02-06 Not applicable No public exploit Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious payload into the login banner and takeover the user account.  
CVE-2024-22240 Medium 2024-02-06 Not applicable No public exploit Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerability leading to unauthorized access to sensitive information.
CVE-2024-22239 High 2024-02-06 Not applicable No public exploit Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this vulnerability to escalate privileges to gain regular shell access.
CVE-2024-22238 Medium 2024-02-06 Not applicable No public exploit Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may be able to inject malicious code into user profile configurations due to improper input sanitization.
CVE-2024-22237 High 2024-02-06 Not applicable No public exploit Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this vulnerability to escalate privileges to gain root access to the system.
CVE-2023-34042 Medium 2024-02-05 Protected by Waratek No public exploit The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be written by anyone with access to the file system. While there are no known exploits, this is an example of “CWE-732: Incorrect Permission Assignment for Critical Resource” and could result in an exploit. Users should update to the latest version of Spring Security to mitigate any future exploits found around this issue.
CVE-2024-22236 Medium 2024-01-31 No exploit published No public exploit In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in the org.springframework.cloud:spring-cloud-contract-shade dependency.
CVE-2024-22233 High 2024-01-22 No exploit published No public exploit In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC * Spring Security 6.1.6+ or 6.2.1+ is on the classpath Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.
CVE-2023-34063 Critical 2024-01-16 Not applicable No public exploit Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows.
CVE-2022-22942 High 2023-12-13 Not applicable Working exploit published The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer.
CVE-2023-34064 Medium 2023-12-12 Not applicable No public exploit Workspace ONE Launcher contains a Privilege Escalation Vulnerability. A malicious actor with physical access to Workspace ONE Launcher could utilize the Edge Panel feature to bypass setup to gain access to sensitive information.
CVE-2023-34055 Medium 2023-11-28 No exploit published No public exploit In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC or Spring WebFlux * org.springframework.boot:spring-boot-actuator is on the classpath
CVE-2023-34053 High 2023-11-28 No exploit published No public exploit In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC or Spring WebFlux * io.micrometer:micrometer-core is on the classpath * an ObservationRegistry is configured in the application to record observations Typically, Spring Boot applications need the org.springframework.boot:spring-boot-actuator dependency to meet all conditions.
CVE-2023-34060 Critical 2023-11-14 Not applicable Exploited VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from an older version. On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network access to the appliance can bypass login restrictions when authenticating on port 22 (ssh) or port 5480 (appliance management console) . This bypass is not present on port 443 (VCD provider and tenant login). On a new installation of VMware Cloud Director Appliance 10.5, the bypass is not present. VMware Cloud Director Appliance is impacted since it uses an affected version of sssd from the underlying Photon OS. The sssd issue is no longer present in versions of Photon OS that ship with sssd-2.8.1-11 or higher (Photon OS 3) or sssd-2.8.2-9 or higher (Photon OS 4 and 5).
CVE-2023-20886 High 2023-10-31 Not applicable No public exploit VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user.
CVE-2023-34059 High 2023-10-27 Not applicable Proof of concept only open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs.
CVE-2023-34058 High 2023-10-27 Not applicable No public exploit VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .
CVE-2023-34057 High 2023-10-27 Not applicable No public exploit VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may elevate privileges within the virtual machine.
CVE-2023-46120 High 2023-10-25 No exploit published Proof of concept only The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.
CVE-2023-46118 Medium 2023-10-25 Not applicable No public exploit RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
CVE-2023-34056 Medium 2023-10-25 Not applicable No public exploit vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data.
CVE-2023-34048 Critical 2023-10-25 Not applicable Exploited vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
CVE-2023-34052 High 2023-10-20 Not applicable No public exploit VMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with non-administrative access to the local system can trigger the deserialization of data which could result in authentication bypass.
CVE-2023-34051 Critical 2023-10-20 Not applicable Proof of concept only VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.
CVE-2023-34046 High 2023-10-20 Not applicable No public exploit VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time.
CVE-2023-34045 High 2023-10-20 Not applicable No public exploit VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed or being installed for the first time.
CVE-2023-34044 High 2023-10-20 Not applicable No public exploit VMware Workstation( 17.x prior to 17.5) and Fusion(13.x prior to 13.5) contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.
CVE-2023-34050 Medium 2023-10-19 Protected by Waratek Proof of concept only In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized. Specifically, an application is vulnerable if * the SimpleMessageConverter or SerializerMessageConverter is used * the user does not configure allowed list patterns * untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content
CVE-2023-34043 Medium 2023-09-27 Not applicable No public exploit VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'.
CVE-2023-34047 Medium 2023-09-20 No exploit published No public exploit A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.
CVE-2023-20900 High 2023-08-31 Not applicable No public exploit A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .
CVE-2023-34039 Critical 2023-08-29 Not applicable Working exploit published Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI.
CVE-2023-20890 High 2023-08-29 Not applicable No public exploit Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to VMware Aria Operations for Networks can write files to arbitrary locations resulting in remote code execution.
CVE-2023-34040 High 2023-08-24 Protected by Waratek Proof of concept only In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers. Specifically, an application is vulnerable when all of the following are true: * The user does not configure an ErrorHandlingDeserializer for the key and/or value of the record * The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true. * The user allows untrusted sources to publish to a Kafka topic By default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record.
CVE-2023-34038 Medium 2023-08-04 Not applicable No public exploit VMware Horizon Server contains an information disclosure vulnerability. A malicious actor with network access may be able to access information relating to the internal network configuration.
CVE-2023-34037 Medium 2023-08-04 Not applicable No public exploit VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests.
CVE-2023-20891 Medium 2023-07-26 Not applicable No public exploit The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs.
CVE-2023-34034 Critical 2023-07-19 No exploit published No public exploit Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.
CVE-2023-34035 High 2023-07-18 No exploit published No public exploit Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet. (DispatcherServlet is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.) Specifically, an application is vulnerable when all of the following are true: * Spring MVC is on the classpath * Spring Security is securing more than one servlet in a single application (one of them being Spring MVC’s DispatcherServlet) * The application uses requestMatchers(String) to refer to endpoints that are not Spring MVC endpoints An application is not vulnerable if any of the following is true: * The application does not have Spring MVC on the classpath * The application secures no servlets other than Spring MVC’s DispatcherServlet * The application uses requestMatchers(String) only for Spring MVC endpoints
CVE-2023-34036 Medium 2023-07-17 No exploit published No public exploit Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server. For the application to be affected, it needs to satisfy the following requirements: * It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses. * The application infrastructure does not guard against clients submitting (X-)Forwarded… headers.
CVE-2023-20899 High 2023-07-06 Not applicable No public exploit VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VMware SD-WAN Management.
CVE-2023-20896 High 2023-06-22 Not applicable Proof of concept only The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds read by sending a specially crafted packet leading to denial-of-service of certain services (vmcad, vmdird, and vmafdd).
CVE-2023-20895 Critical 2023-06-22 Not applicable Proof of concept only The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication.
CVE-2023-20894 Critical 2023-06-22 Not applicable Proof of concept only The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to memory corruption.
CVE-2023-20893 Critical 2023-06-22 Not applicable Proof of concept only The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server.
CVE-2023-20892 Critical 2023-06-22 Not applicable Proof of concept only The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server.
CVE-2023-20867 Low 2023-06-13 Not applicable Exploited A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
CVE-2023-20889 High 2023-06-07 Not applicable Working exploit published Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in information disclosure.
CVE-2023-20888 High 2023-06-07 Not applicable Working exploit published Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution.
CVE-2023-20887 Critical 2023-06-07 Not applicable Exploited Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
CVE-2022-31693 Medium 2023-06-07 Not applicable No public exploit VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges in the Windows guest OS, where VMware Tools is installed, can trigger a PANIC in the VM3DMP driver leading to a denial-of-service condition in the Windows guest OS.
CVE-2023-20884 Medium 2023-05-30 Not applicable No public exploit VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect a victim to an attacker controlled domain due to improper path handling leading to sensitive information disclosure.
CVE-2023-20883 High 2023-05-26 No exploit published No public exploit In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
CVE-2023-31131 Critical 2023-05-15 Not applicable No public exploit Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extract tar files within GPPKGs. greenplum-db is vulnerable to path traversal leading to arbitrary file writes. An attacker can use this vulnerability to overwrite data or system files potentially leading to crash or malfunction of the system. Any files which are accessible to the running process are at risk. All users are requested to upgrade to Greenplum Database version 6.23.2 or higher. There are no known workarounds for this vulnerability.
CVE-2023-20880 Medium 2023-05-12 Not applicable No public exploit VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'.
CVE-2023-20879 Medium 2023-05-12 Not applicable No public exploit VMware Aria Operations contains a Local privilege escalation vulnerability. A malicious actor with administrative privileges in the Aria Operations application can gain root access to the underlying operating system.
CVE-2023-20878 High 2023-05-12 Not applicable No public exploit VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt the system.
CVE-2023-20877 High 2023-05-12 Not applicable No public exploit VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leading to privilege escalation.
CVE-2023-29552 High 2023-04-25 Not applicable Exploited The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.
CVE-2023-20872 High 2023-04-25 Not applicable Proof of concept only VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device emulation.
CVE-2023-20871 High 2023-04-25 Not applicable No public exploit VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system can elevate privileges to gain root access to the host operating system.
CVE-2023-20870 Medium 2023-04-25 Not applicable No public exploit VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.
CVE-2023-20869 High 2023-04-25 Not applicable No public exploit VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.
CVE-2023-20873 Critical 2023-04-20 No exploit published No public exploit In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users should upgrade to 2.7.11+. Users of older, unsupported versions should upgrade to 3.0.6+ or 2.7.11+.
CVE-2023-20865 High 2023-04-20 Not applicable No public exploit VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root.
‹ prev page 3 of 11 next ›