Vulnerabilities (CVE)

Filtered by vendor Vmware Subscribe
Filtered by product Cloud Foundation
Total 99 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-31699 1 Vmware 2 Cloud Foundation, Esxi 2024-02-28 N/A 3.3 LOW
VMware ESXi contains a heap-overflow vulnerability. A malicious local actor with restricted privileges within a sandbox process may exploit this issue to achieve a partial information disclosure.
CVE-2022-22982 1 Vmware 2 Cloud Foundation, Vcenter Server 2024-02-28 N/A 7.5 HIGH
The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.
CVE-2022-31678 1 Vmware 2 Cloud Foundation, Nsx Data Center 2024-02-28 N/A 9.1 CRITICAL
VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure.
CVE-2022-31681 1 Vmware 2 Cloud Foundation, Esxi 2024-02-28 N/A 6.5 MEDIUM
VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a denial of service condition on the host.
CVE-2022-22973 2 Linux, Vmware 5 Linux Kernel, Cloud Foundation, Identity Manager and 2 more 2024-02-28 7.2 HIGH 7.8 HIGH
VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.
CVE-2021-22042 1 Vmware 2 Cloud Foundation, Esxi 2024-02-28 4.6 MEDIUM 7.8 HIGH
VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within the VMX process only, may be able to access settingsd service running as a high privileged user.
CVE-2022-22945 1 Vmware 2 Cloud Foundation, Nsx Data Center 2024-02-28 7.2 HIGH 7.8 HIGH
VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the operating system as root.
CVE-2022-22961 2 Linux, Vmware 6 Linux Kernel, Cloud Foundation, Identity Manager and 3 more 2024-02-28 5.0 MEDIUM 5.3 MEDIUM
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A malicious actor with remote access may leak the hostname of the target system. Successful exploitation of this issue can lead to targeting victims.
CVE-2022-22972 2 Linux, Vmware 6 Linux Kernel, Cloud Foundation, Identity Manager and 3 more 2024-02-28 7.5 HIGH 9.8 CRITICAL
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
CVE-2022-22959 2 Linux, Vmware 6 Linux Kernel, Cloud Foundation, Identity Manager and 3 more 2024-02-28 4.3 MEDIUM 4.3 MEDIUM
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user through a cross site request forgery to unintentionally validate a malicious JDBC URI.
CVE-2022-22958 2 Linux, Vmware 6 Linux Kernel, Cloud Foundation, Identity Manager and 3 more 2024-02-28 6.5 MEDIUM 7.2 HIGH
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.
CVE-2021-22040 1 Vmware 5 Cloud Foundation, Esxi, Fusion and 2 more 2024-02-28 4.6 MEDIUM 6.7 MEDIUM
VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
CVE-2021-22041 1 Vmware 4 Cloud Foundation, Esxi, Fusion and 1 more 2024-02-28 4.6 MEDIUM 6.7 MEDIUM
VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
CVE-2021-22050 1 Vmware 2 Cloud Foundation, Esxi 2024-02-28 5.0 MEDIUM 7.5 HIGH
ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. A malicious actor with network access to ESXi may exploit this issue to create a denial-of-service condition by overwhelming rhttpproxy service with multiple requests.
CVE-2022-22954 2 Linux, Vmware 6 Linux Kernel, Cloud Foundation, Identity Manager and 3 more 2024-02-28 10.0 HIGH 9.8 CRITICAL
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
CVE-2022-22957 2 Linux, Vmware 6 Linux Kernel, Cloud Foundation, Identity Manager and 3 more 2024-02-28 6.5 MEDIUM 7.2 HIGH
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.
CVE-2021-22012 1 Vmware 2 Cloud Foundation, Vcenter Server 2024-02-28 5.0 MEDIUM 7.5 HIGH
The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.
CVE-2022-22939 1 Vmware 1 Cloud Foundation 2024-02-28 4.0 MEDIUM 4.9 MEDIUM
VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext within one or more log files.
CVE-2021-22019 1 Vmware 2 Cloud Foundation, Vcenter Server 2024-02-28 5.0 MEDIUM 7.5 HIGH
The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 5480 on vCenter Server may exploit this issue by sending a specially crafted jsonrpc message to create a denial of service condition.
CVE-2021-22020 1 Vmware 2 Cloud Foundation, Vcenter Server 2024-02-28 2.1 LOW 5.5 MEDIUM
The vCenter Server contains a denial-of-service vulnerability in the Analytics service. Successful exploitation of this issue may allow an attacker to create a denial-of-service condition on vCenter Server.