Vulnerabilities (CVE)

Filtered by vendor Vmware Subscribe
Total 896 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-31008 1 Vmware 1 Rabbitmq 2024-11-21 N/A 5.5 MEDIUM
RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable the Shovel and Federation plugins.
CVE-2022-29901 5 Debian, Fedoraproject, Intel and 2 more 254 Debian Linux, Fedora, Core I3-6100 and 251 more 2024-11-21 1.9 LOW 5.6 MEDIUM
Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.
CVE-2022-27772 1 Vmware 1 Spring Boot 2024-11-21 4.6 MEDIUM 7.8 HIGH
spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that are no longer supported by the maintainer
CVE-2022-23825 4 Amd, Debian, Fedoraproject and 1 more 249 A10-9600p, A10-9600p Firmware, A10-9630p and 246 more 2024-11-21 2.1 LOW 6.5 MEDIUM
Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure.
CVE-2022-22983 1 Vmware 1 Workstation 2024-11-21 N/A 5.9 MEDIUM
VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability. A malicious actor with local user privileges to the victim machine may exploit this vulnerability leading to the disclosure of user passwords of the remote server connected through VMware Workstation.
CVE-2022-22982 1 Vmware 2 Cloud Foundation, Vcenter Server 2024-11-21 N/A 7.5 HIGH
The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.
CVE-2022-22980 1 Vmware 1 Spring Data Mongodb 2024-11-21 6.8 MEDIUM 9.8 CRITICAL
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
CVE-2022-22979 1 Vmware 1 Spring Cloud Function 2024-11-21 5.0 MEDIUM 7.5 HIGH
In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Function Catalog component of the framework.
CVE-2022-22978 3 Netapp, Oracle, Vmware 3 Active Iq Unified Manager, Financial Services Crime And Compliance Management Studio, Spring Security 2024-11-21 7.5 HIGH 9.8 CRITICAL
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
CVE-2022-22977 2 Microsoft, Vmware 2 Windows, Tools 2024-11-21 3.6 LOW 7.1 HIGH
VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administrative local user privileges in the Windows guest OS, where VMware Tools is installed, may exploit this issue leading to a denial-of-service condition or unintended information disclosure.
CVE-2022-22976 3 Netapp, Oracle, Vmware 3 Active Iq Unified Manager, Financial Services Crime And Compliance Management Studio, Spring Security 2024-11-21 4.3 MEDIUM 5.3 MEDIUM
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.
CVE-2022-22975 1 Vmware 1 Pinniped 2024-11-21 6.0 MEDIUM 6.6 MEDIUM
An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name (CN) of their user entry on the LDAP or AD server to include special characters, which could be used to perform LDAP query injection on the Supervisor's LDAP query which determines their Kubernetes group membership.
CVE-2022-22973 2 Linux, Vmware 5 Linux Kernel, Cloud Foundation, Identity Manager and 2 more 2024-11-21 7.2 HIGH 7.8 HIGH
VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.
CVE-2022-22972 2 Linux, Vmware 6 Linux Kernel, Cloud Foundation, Identity Manager and 3 more 2024-11-21 7.5 HIGH 9.8 CRITICAL
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
CVE-2022-22971 3 Netapp, Oracle, Vmware 4 Cloud Secure Agent, Oncommand Insight, Financial Services Crime And Compliance Management Studio and 1 more 2024-11-21 4.0 MEDIUM 6.5 MEDIUM
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
CVE-2022-22970 3 Netapp, Oracle, Vmware 6 Active Iq Unified Manager, Brocade San Navigator, Cloud Secure Agent and 3 more 2024-11-21 3.5 LOW 5.3 MEDIUM
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
CVE-2022-22968 3 Netapp, Oracle, Vmware 7 Active Iq Unified Manager, Cloud Secure Agent, Metrocluster Tiebreaker and 4 more 2024-11-21 5.0 MEDIUM 5.3 MEDIUM
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
CVE-2022-22966 1 Vmware 1 Vcloud Director 2024-11-21 6.5 MEDIUM 7.2 HIGH
An authenticated, high privileged malicious actor with network access to the VMware Cloud Director tenant or provider may be able to exploit a remote code execution vulnerability to gain access to the server.
CVE-2022-22965 5 Cisco, Oracle, Siemens and 2 more 39 Cx Cloud Agent, Commerce Platform, Communications Cloud Native Core Automated Test Suite and 36 more 2024-11-21 7.5 HIGH 9.8 CRITICAL
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22964 2 Linux, Vmware 2 Linux Kernel, Horizon 2024-11-21 7.2 HIGH 7.8 HIGH
VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation that allows a user to escalate to root due to a vulnerable configuration file.