CVSS: 8.8EPSS: 0%CPEs: 266EXPL: 0CVE-2022-31696 – VMware ESXi TCP/IP Memory Corruption Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-31696
13 Dec 2022 — VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory leading to an escape of the ESXi sandbox. VMware ESXi contiene una vulnerabilidad de corrupción de memoria que existe en la forma en que maneja un socket de red. Un actor malintencionado con acceso local a ESXi puede aprovechar este problema para dañar la memoria y provocar un escape del entorno limitado de ESXi. This ... • https://www.vmware.com/security/advisories/VMSA-2022-0030.html • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 21EXPL: 0CVE-2022-31681
https://notcve.org/view.php?id=CVE-2022-31681
07 Oct 2022 — VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a denial of service condition on the host. VMware ESXi contiene una vulnerabilidad de deferencia de puntero null. Un actor malicioso con privilegios dentro del proceso VMX solamente, puede crear una condición de negación de servicio en el host • https://www.vmware.com/security/advisories/VMSA-2022-0025.html • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 69EXPL: 0CVE-2022-22982 – VMware Security Advisory 2022-0018
https://notcve.org/view.php?id=CVE-2022-22982
12 Jul 2022 — The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service. El servidor vCenter contiene una vulnerabilidad de tipo server-side request forgery (SSRF). Un actor malicioso con acceso de red a 443 en el vCenter Server puede explotar este problema al acceder a una petición de URL fuera del vCenter Server o accediendo... • https://www.vmware.com/security/advisories/VMSA-2022-0018.html • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 46%CPEs: 61EXPL: 3CVE-2022-22972
https://notcve.org/view.php?id=CVE-2022-22972
20 May 2022 — VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate. VMware Workspace ONE Access, Identity Manager y vRealize Automation contienen una vulnerabilidad de omisión de autenticación que afecta a usuarios del dominio local. Un actor malicioso con acceso de red a la interfaz de usuario puede obten... • https://github.com/horizon3ai/CVE-2022-22972 •
CVSS: 7.8EPSS: 0%CPEs: 40EXPL: 0CVE-2022-22973
https://notcve.org/view.php?id=CVE-2022-22973
20 May 2022 — VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'. VMware Workspace ONE Access y Identity Manager contienen una vulnerabilidad de escalada de privilegios. Un actor malicioso con acceso local puede escalar los privilegios a "root" • https://www.vmware.com/security/advisories/VMSA-2022-0014.html •
CVSS: 7.2EPSS: 0%CPEs: 13EXPL: 0CVE-2022-22958
https://notcve.org/view.php?id=CVE-2022-22958
13 Apr 2022 — VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution. VMware Workspace ONE Access, Identity Manager y vRealize Automation contienen dos vulnerabilidades de ejecución de código remota (CVE-2022-22957 y CVE-2022-22958). Un actor malicioso con acceso ad... • https://www.vmware.com/security/advisories/VMSA-2022-0011.html • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.3EPSS: 0%CPEs: 13EXPL: 0CVE-2022-22961
https://notcve.org/view.php?id=CVE-2022-22961
13 Apr 2022 — VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A malicious actor with remote access may leak the hostname of the target system. Successful exploitation of this issue can lead to targeting victims. VMware Workspace ONE Access, Identity Manager y vRealize Automation contienen una vulnerabilidad de divulgación de información debido a una devolución de información excesiva. Un actor malicioso con acceso r... • https://www.vmware.com/security/advisories/VMSA-2022-0011.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0CVE-2022-22959
https://notcve.org/view.php?id=CVE-2022-22959
13 Apr 2022 — VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user through a cross site request forgery to unintentionally validate a malicious JDBC URI. VMware Workspace ONE Access, Identity Manager y vRealize Automation contienen una vulnerabilidad de tipo cross site request forgery. Un actor malicioso puede engañar a un usuario mediante un ataque de tipo cross site request forgery para que compruebe involuntariament... • https://www.vmware.com/security/advisories/VMSA-2022-0011.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 5CVE-2022-22960 – VMware Multiple Products Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-22960
13 Apr 2022 — VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'. VMware Workspace ONE Access, Identity Manager y vRealize Automation contienen una vulnerabilidad de escalada de privilegios debido a permisos inapropiados en scripts de soporte. Un actor malicioso con acceso local puede escalar los privilegios a "root" VMware Workspace ONE Acce... • https://packetstorm.news/files/id/171935 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.2EPSS: 1%CPEs: 13EXPL: 1CVE-2022-22957 – VMware Workspace ONE Remote Code Execution
https://notcve.org/view.php?id=CVE-2022-22957
13 Apr 2022 — VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution. VMware Workspace ONE Access, Identity Manager y vRealize Automation contienen dos vulnerabilidades de ejecución de código remota (CVE-2022-22957 y CVE-2022-22958). Un actor malicioso con acceso ad... • https://packetstorm.news/files/id/171918 • CWE-502: Deserialization of Untrusted Data •