Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Vmware Subscribe
Filtered by product Cloud Foundation
Total 86 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-22015 1 Vmware 2 Cloud Foundation, Vcenter Server 2023-02-03 7.2 HIGH 7.8 HIGH
The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.
CVE-2020-3963 1 Vmware 4 Cloud Foundation, Esxi, Fusion and 1 more 2023-01-27 2.1 LOW 5.5 MEDIUM
VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before 11.5.2) contain a use-after-free vulnerability in PVNVRAM. A malicious actor with local access to a virtual machine may be able to read privileged information contained in physical memory.
CVE-2021-22048 1 Vmware 2 Cloud Foundation, Vcenter Server 2023-01-19 6.5 MEDIUM 8.8 HIGH
The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A malicious actor with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group.
CVE-2022-31700 2 Microsoft, Vmware 4 Windows, Access, Cloud Foundation and 1 more 2022-12-20 N/A 7.2 HIGH
VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2.
CVE-2022-31701 2 Linux, Vmware 4 Linux Kernel, Access, Cloud Foundation and 1 more 2022-12-20 N/A 5.3 MEDIUM
VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3.
CVE-2022-31696 1 Vmware 2 Cloud Foundation, Esxi 2022-12-16 N/A 8.8 HIGH
VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory leading to an escape of the ESXi sandbox.
CVE-2022-31699 1 Vmware 2 Cloud Foundation, Esxi 2022-12-15 N/A 3.3 LOW
VMware ESXi contains a heap-overflow vulnerability. A malicious local actor with restricted privileges within a sandbox process may exploit this issue to achieve a partial information disclosure.
CVE-2022-31698 1 Vmware 2 Cloud Foundation, Vcenter Server 2022-12-15 N/A 5.3 MEDIUM
The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to trigger a denial-of-service condition by sending a specially crafted header.
CVE-2022-31697 1 Vmware 2 Cloud Foundation, Vcenter Server 2022-12-15 N/A 5.5 MEDIUM
The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with access to a workstation that invoked a vCenter Server Appliance ISO operation (Install/Upgrade/Migrate/Restore) can access plaintext passwords used during that operation.
CVE-2022-31678 1 Vmware 2 Cloud Foundation, Nsx Data Center 2022-10-31 N/A 9.1 CRITICAL
VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure.
CVE-2022-31681 1 Vmware 2 Cloud Foundation, Esxi 2022-10-11 N/A 6.5 MEDIUM
VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a denial of service condition on the host.
CVE-2022-22954 2 Linux, Vmware 6 Linux Kernel, Cloud Foundation, Identity Manager and 3 more 2022-09-09 10.0 HIGH 9.8 CRITICAL
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
CVE-2022-22982 1 Vmware 2 Cloud Foundation, Vcenter Server 2022-07-20 N/A 7.5 HIGH
The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.
CVE-2021-21986 1 Vmware 2 Cloud Foundation, Vcenter Server 2022-07-12 10.0 HIGH 9.8 CRITICAL
The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A malicious actor with network access to port 443 on vCenter Server may perform actions allowed by the impacted plug-ins without authentication.
CVE-2021-22007 1 Vmware 2 Cloud Foundation, Vcenter Server 2022-07-12 2.1 LOW 5.5 MEDIUM
The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administrative privilege may exploit this issue to gain access to sensitive information.
CVE-2021-21991 1 Vmware 2 Cloud Foundation, Vcenter Server 2022-07-12 4.6 MEDIUM 7.8 HIGH
The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens. A malicious actor with non-administrative user access on vCenter Server host may exploit this issue to escalate privileges to Administrator on the vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash).
CVE-2021-22008 1 Vmware 2 Cloud Foundation, Vcenter Server 2022-07-12 5.0 MEDIUM 7.5 HIGH
The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by sending a specially crafted json-rpc message to gain access to sensitive information.
CVE-2021-22012 1 Vmware 2 Cloud Foundation, Vcenter Server 2022-07-12 5.0 MEDIUM 7.5 HIGH
The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.
CVE-2021-21992 1 Vmware 2 Cloud Foundation, Vcenter Server 2022-07-12 6.8 MEDIUM 6.5 MEDIUM
The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing. A malicious actor with non-administrative user access to the vCenter Server vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash) may exploit this issue to create a denial-of-service condition on the vCenter Server host.
CVE-2021-21972 1 Vmware 2 Cloud Foundation, Vcenter Server 2022-07-12 10.0 HIGH 9.8 CRITICAL
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).