CVSS: 7.8EPSS: 0%CPEs: 218EXPL: 0CVE-2021-22045 – VMware Workstation SCSI Heap-based Buffer Overflow Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-22045
VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine. VMware ESXi (versiones 7.0, 6.7 anteriores a ESXi670-202111101-SG y 6.5 anteriores a ESXi650-202110101-SG), VMware Workstation (versión 16.2.0) y VMware Fusion (versión 12.2.0), contienen una vulnerabilidad de desbordamiento de pila en la emulación de dispositivos de CD-ROM. Un actor malicioso con acceso a una máquina virtual con emulación de dispositivo de CD-ROM puede ser capaz de explotar esta vulnerabilidad en conjunto con otros problemas para ejecutar código en el hipervisor desde una máquina virtual This vulnerability allows local attackers to escalate privileges on affected installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the SCSI component. • http://packetstormsecurity.com/files/165440/VMware-Security-Advisory-2022-0001.html https://www.vmware.com/security/advisories/VMSA-2022-0001.html https://www.zerodayinitiative.com/advisories/ZDI-22-003 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 238EXPL: 0CVE-2021-21995
https://notcve.org/view.php?id=CVE-2021-21995
OpenSLP as used in ESXi has a denial-of-service vulnerability due a heap out-of-bounds read issue. A malicious actor with network access to port 427 on ESXi may be able to trigger a heap out-of-bounds read in OpenSLP service resulting in a denial-of-service condition. OpenSLP, tal como se utiliza en ESXi, presenta una vulnerabilidad de denegación de servicio debido a un problema de lectura fuera de límites de la pila. Un actor malicioso con acceso de red al puerto 427 en ESXi puede ser capaz de desencadenar una lectura fuera de límites de la pila en el servicio OpenSLP, resultando en una condición de denegación de servicio • https://www.vmware.com/security/advisories/VMSA-2021-0014.html • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 238EXPL: 0CVE-2021-21994
https://notcve.org/view.php?id=CVE-2021-21994
SFCB (Small Footprint CIM Broker) as used in ESXi has an authentication bypass vulnerability. A malicious actor with network access to port 5989 on ESXi may exploit this issue to bypass SFCB authentication by sending a specially crafted request. SFCB (Small Footprint CIM Broker), tal y como se utiliza en ESXi, presenta una vulnerabilidad en la omisión de la autenticación. Un actor malicioso con acceso de red al puerto 5989 en ESXi puede explotar este problema para omitir la autenticación de SFCB al enviar una petición especialmente diseñada • https://www.vmware.com/security/advisories/VMSA-2021-0014.html • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 93%CPEs: 233EXPL: 3CVE-2021-21974 – VMware ESXi SLP Heap-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-21974
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution. OpenSLP como es usado en ESXi (versiones 7.0 anteriores a ESXi70U1c-17325551, versiones 6.7 anteriores a ESXi670-202102401-SG, versiones 6.5 anteriores a ESXi650-202102101-SG), presenta una vulnerabilidad de desbordamiento de la pila. Un actor malicioso que reside dentro del mismo segmento de red que ESXi y que presenta acceso al puerto 427 puede desencadenar el problema de desbordamiento de la pila en el servicio OpenSLP, resultando en una ejecución de código remota This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of VMware ESXi. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SLP messages. • https://github.com/Shadow0ps/CVE-2021-21974 https://github.com/n2x4/Feb2023-CVE-2021-21974-OSINT http://packetstormsecurity.com/files/162957/VMware-ESXi-OpenSLP-Heap-Overflow.html https://www.vmware.com/security/advisories/VMSA-2021-0002.html https://www.zerodayinitiative.com/advisories/ZDI-21-250 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-3999 – VMware Workstation SetGuestInfo Null Pointer Dereference Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2020-3999
VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and VMware Cloud Foundation contain a denial of service vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of service condition. VMware ESXi (versiones 7.0 anteriores a ESXi70U1c-17325551), VMware Workstation (versiones 16.x anteriores a 16.0 y versiones 15.x anteriores a 15.5.7), VMware Fusion (versiones 12.x anteriores a 12.0 y versiones 11.x anteriores a 11.5.7) y VMware Cloud Foundation contienen una vulnerabilidad de denegación de servicio debido a una comprobación inapropiada de la entrada en GuestInfo. Un actor malicioso con acceso privilegiado de usuario normal para una máquina virtual puede bloquear el proceso vmx de la máquina virtual y causar una condición de denegación de servicio This vulnerability allows local attackers to create a denial-of-service condition on affected installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the implementation of the SetGuestInfo RPC function. • https://www.vmware.com/security/advisories/VMSA-2020-0029.html • CWE-20: Improper Input Validation •