A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
CVE-2022-22963 is a high severity remote code execution vulnerability in VMware Tanzu Spring Cloud Function. It arises from the routing functionality where a specially crafted Spring Expression Language (SpEL) routing-expression can be used by an attacker to execute arbitrary code and access local resources. This vulnerability has been exploited in the wild.
Spring Cloud Gateway applications with the Gateway Actuator endpoint enabled, exposed, and unsecured are vulnerable to a code injection attack. This vulnerability allows attackers to execute arbitrary code remotely. It has been exploited in the wild and is considered a high severity threat.
CVE-2022-22960 is a privilege escalation vulnerability affecting multiple VMware products including Workspace ONE Access, Identity Manager, and vRealize Automation. The issue arises from improper permissions set on support scripts, allowing unauthorized privilege escalation. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2022-22954 is a high-severity vulnerability in VMware Workspace ONE Access and Identity Manager that allows remote code execution via server-side template injection. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.
CVE-2022-22965 is a high-severity remote code execution vulnerability affecting Spring Framework applications running on JDK 9 or later. It arises from unsafe data binding in Spring MVC or Spring WebFlux, allowing attackers to execute arbitrary code remotely. This vulnerability has been exploited in the wild.
VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in its local web UI component. Exploiting this vulnerability can lead to remote code execution on the affected device. This vulnerability has been observed to be exploited in the wild. No specific affected versions or patch information is provided.
CVE-2020-5410 is a path traversal vulnerability in VMware Tanzu's Spring Cloud Config Server that allows attackers to access arbitrary configuration files. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.
CVE-2018-1273 is a high-severity vulnerability in VMware Tanzu Spring Data Commons involving a property binder flaw that allows remote code execution. It has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
VMware vCenter Server and Cloud Foundation contain a Server Side Request Forgery (SSRF) vulnerability due to improper validation of URLs in a vCenter Server plugin. This vulnerability allows attackers to perform SSRF attacks that can lead to information disclosure. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.
CVE-2021-21975 is a Server Side Request Forgery (SSRF) vulnerability in VMware vRealize Operations Manager API versions prior to 8.4. This flaw allows an attacker with network access to the API to perform SSRF attacks that can lead to theft of administrative credentials. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns.
CVE-2021-22017 is a high-severity vulnerability in VMware vCenter Server involving improper access control due to flawed URI normalization in the rhttproxy component. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2019-5544 is a heap-based buffer overflow vulnerability in the OpenSLP service of VMware ESXi and Horizon Desktop as a Service (DaaS). It allows an attacker with network access to port 427 to overwrite the heap memory of the OpenSLP service, potentially enabling remote code execution. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information are provided in the available data.
CVE-2020-3992 is a use-after-free vulnerability in VMware ESXi's OpenSLP service. It allows an attacker with access to the management network and port 427 to execute code remotely. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.
VMware vCenter Server has an information disclosure vulnerability in its VMware Directory Service (vmdir) component related to improper access control in the Platform Services Controller (PSC). An attacker with network access to port 389 can exploit this flaw to extract sensitive information. This vulnerability has been exploited in the wild and is considered high severity.
CVE-2021-21972 is a remote code execution vulnerability in the VMware vCenter Server vSphere Client plugin. It allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.
CVE-2021-21985 is a high-severity vulnerability in VMware vCenter Server's vSphere Client, specifically in the Virtual SAN Health Check plug-in enabled by default. It involves improper input validation that allows remote code execution. The vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.
CVE-2020-3950 is a privilege escalation vulnerability affecting VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac. The flaw arises from improper use of setuid binaries, allowing attackers to escalate privileges to root. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2020-4006 is a command injection vulnerability affecting multiple VMware products including Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. An attacker with network access to the administrative configurator on port 8443 and valid administrator credentials can execute arbitrary commands with unrestricted privileges on the underlying operating system. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
