CVSS: 7.5EPSS: 0%CPEs: 238EXPL: 0CVE-2021-21995
https://notcve.org/view.php?id=CVE-2021-21995
OpenSLP as used in ESXi has a denial-of-service vulnerability due a heap out-of-bounds read issue. A malicious actor with network access to port 427 on ESXi may be able to trigger a heap out-of-bounds read in OpenSLP service resulting in a denial-of-service condition. OpenSLP, tal como se utiliza en ESXi, presenta una vulnerabilidad de denegación de servicio debido a un problema de lectura fuera de límites de la pila. Un actor malicioso con acceso de red al puerto 427 en ESXi puede ser capaz de desencadenar una lectura fuera de límites de la pila en el servicio OpenSLP, resultando en una condición de denegación de servicio • https://www.vmware.com/security/advisories/VMSA-2021-0014.html • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 238EXPL: 0CVE-2021-21994
https://notcve.org/view.php?id=CVE-2021-21994
SFCB (Small Footprint CIM Broker) as used in ESXi has an authentication bypass vulnerability. A malicious actor with network access to port 5989 on ESXi may exploit this issue to bypass SFCB authentication by sending a specially crafted request. SFCB (Small Footprint CIM Broker), tal y como se utiliza en ESXi, presenta una vulnerabilidad en la omisión de la autenticación. Un actor malicioso con acceso de red al puerto 5989 en ESXi puede explotar este problema para omitir la autenticación de SFCB al enviar una petición especialmente diseñada • https://www.vmware.com/security/advisories/VMSA-2021-0014.html • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 93%CPEs: 233EXPL: 3CVE-2021-21974 – VMware ESXi SLP Heap-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-21974
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution. OpenSLP como es usado en ESXi (versiones 7.0 anteriores a ESXi70U1c-17325551, versiones 6.7 anteriores a ESXi670-202102401-SG, versiones 6.5 anteriores a ESXi650-202102101-SG), presenta una vulnerabilidad de desbordamiento de la pila. Un actor malicioso que reside dentro del mismo segmento de red que ESXi y que presenta acceso al puerto 427 puede desencadenar el problema de desbordamiento de la pila en el servicio OpenSLP, resultando en una ejecución de código remota This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of VMware ESXi. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SLP messages. • https://github.com/Shadow0ps/CVE-2021-21974 https://github.com/n2x4/Feb2023-CVE-2021-21974-OSINT http://packetstormsecurity.com/files/162957/VMware-ESXi-OpenSLP-Heap-Overflow.html https://www.vmware.com/security/advisories/VMSA-2021-0002.html https://www.zerodayinitiative.com/advisories/ZDI-21-250 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-3999 – VMware Workstation SetGuestInfo Null Pointer Dereference Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2020-3999
VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and VMware Cloud Foundation contain a denial of service vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of service condition. VMware ESXi (versiones 7.0 anteriores a ESXi70U1c-17325551), VMware Workstation (versiones 16.x anteriores a 16.0 y versiones 15.x anteriores a 15.5.7), VMware Fusion (versiones 12.x anteriores a 12.0 y versiones 11.x anteriores a 11.5.7) y VMware Cloud Foundation contienen una vulnerabilidad de denegación de servicio debido a una comprobación inapropiada de la entrada en GuestInfo. Un actor malicioso con acceso privilegiado de usuario normal para una máquina virtual puede bloquear el proceso vmx de la máquina virtual y causar una condición de denegación de servicio This vulnerability allows local attackers to create a denial-of-service condition on affected installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the implementation of the SetGuestInfo RPC function. • https://www.vmware.com/security/advisories/VMSA-2020-0029.html • CWE-20: Improper Input Validation •
CVSS: 8.2EPSS: 0%CPEs: 184EXPL: 0CVE-2020-4004
https://notcve.org/view.php?id=CVE-2020-4004
VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. VMware ESXi (versiones 7.0 anteriores a ESXi70U1b-17168206, versiones 6.7 anteriores a ESXi670-202011101-SG, versiones 6.5 anteriores a ESXi650-202011301-SG), Workstation (versiones 15.x anteriores a 15.5.7), Fusion (versiones 11.x anteriores a 11.5.7), contienen una vulnerabilidad de uso de la memoria previamente liberada en el controlador USB XHCI. Un actor malicioso con privilegios administrativos locales en una máquina virtual puede explotar este problema para ejecutar código como el proceso VMX de la máquina virtual que se ejecuta en el host • https://www.vmware.com/security/advisories/VMSA-2020-0026.html • CWE-416: Use After Free •