CVSS: 10.0EPSS: 3%CPEs: 33EXPL: 0CVE-2023-20893
https://notcve.org/view.php?id=CVE-2023-20893
22 Jun 2023 — The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server. The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlyin... • https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1799 • CWE-416: Use After Free •
CVSS: 10.0EPSS: 3%CPEs: 33EXPL: 0CVE-2023-20892 – VMware vCenter Server heap-overflow vulnerability
https://notcve.org/view.php?id=CVE-2023-20892
22 Jun 2023 — The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server. The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access ... • https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1801 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 70EXPL: 0CVE-2022-31697
https://notcve.org/view.php?id=CVE-2022-31697
13 Dec 2022 — The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with access to a workstation that invoked a vCenter Server Appliance ISO operation (Install/Upgrade/Migrate/Restore) can access plaintext passwords used during that operation. vCenter Server contiene una vulnerabilidad de divulgación de información debido al registro de credenciales en texto plano. Un actor malintencionado con acceso a una estación de trabajo que invocó una o... • https://www.vmware.com/security/advisories/VMSA-2022-0030.html • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 5.3EPSS: 5%CPEs: 105EXPL: 0CVE-2022-31698
https://notcve.org/view.php?id=CVE-2022-31698
13 Dec 2022 — The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to trigger a denial-of-service condition by sending a specially crafted header. vCenter Server contiene una vulnerabilidad de Denegación de Servicio (DoS) en el servicio de librería de contenido. Un actor malintencionado con acceso de red al puerto 443 en vCenter Server puede aprovechar este problema para desencadenar una con... • https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1588 •
CVSS: 9.1EPSS: 0%CPEs: 28EXPL: 1CVE-2022-31680
https://notcve.org/view.php?id=CVE-2022-31680
07 Oct 2022 — The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server. El servidor vCenter contiene una vulnerabilidad de deserialización no segura en el PSC (Platform services controller). Un actor malicioso con acceso de administrador en el servidor vCenter puede aprovechar este problema para ejecuta... • https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1587 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 0%CPEs: 69EXPL: 0CVE-2022-22982 – VMware Security Advisory 2022-0018
https://notcve.org/view.php?id=CVE-2022-22982
12 Jul 2022 — The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service. El servidor vCenter contiene una vulnerabilidad de tipo server-side request forgery (SSRF). Un actor malicioso con acceso de red a 443 en el vCenter Server puede explotar este problema al acceder a una petición de URL fuera del vCenter Server o accediendo... • https://www.vmware.com/security/advisories/VMSA-2022-0018.html • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.5EPSS: 12%CPEs: 63EXPL: 1CVE-2022-22948 – VMware vCenter Server Incorrect Default File Permissions Vulnerability
https://notcve.org/view.php?id=CVE-2022-22948
29 Mar 2022 — The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information. vCenter Server contiene una vulnerabilidad de divulgación de información debido a un permiso inapropiado de los archivos. Un actor malicioso con acceso no administrativo al vCenter Server puede explotar este problema para conseguir acceso a información confidencial VMware... • https://github.com/PenteraIO/CVE-2022-22948 • CWE-276: Incorrect Default Permissions •
CVSS: 9.8EPSS: 1%CPEs: 3EXPL: 0CVE-2021-22049
https://notcve.org/view.php?id=CVE-2021-22049
24 Nov 2021 — The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service. El cliente web de vSphere (FLEX/Flash) contiene una vulnerabilidad de tipo SSRF (Server Side Request Forgery) en el plugin del cliente web de vSAN (vSAN UI). Un actor malicioso con acceso de red ... • https://www.vmware.com/security/advisories/VMSA-2021-0027.html • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 17%CPEs: 36EXPL: 1CVE-2021-21980
https://notcve.org/view.php?id=CVE-2021-21980
24 Nov 2021 — The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information. El cliente web de vSphere (FLEX/Flash), contiene una vulnerabilidad de lectura arbitraria de archivos no autorizada. Un actor malicioso con acceso a la red al puerto 443 en vCenter Server puede explotar este problema para conseguir acceso a información confidencial • https://github.com/Osyanina/westone-CVE-2021-21980-scanner •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-22048 – VMware Security Advisory 2022-0025.2
https://notcve.org/view.php?id=CVE-2021-22048
10 Nov 2021 — The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A malicious actor with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group. vCenter Server contiene una vulnerabilidad de escalada de privilegios en el mecanismo de autenticación IWA (Integrated Windows Authentication). Un actor malicioso con acceso no administrativo a vCenter Server podría explotar este pr... • http://packetstormsecurity.com/files/167733/VMware-Security-Advisory-2022-0025.2.html •