CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0CVE-2022-22939
https://notcve.org/view.php?id=CVE-2022-22939
VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext within one or more log files. VMware Cloud Foundation contiene una vulnerabilidad de divulgación de información debido al registro de credenciales en texto plano dentro de varios archivos de registro en el SDDC Manager. Un actor malicioso con acceso a root en VMware Cloud Foundation SDDC Manager puede ser capaz de visualizar las credenciales en texto plano dentro de uno o más archivos de registro • https://www.vmware.com/security/advisories/VMSA-2022-0003.html • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-22938
https://notcve.org/view.php?id=CVE-2022-22938
VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueType font parser. A malicious actor with access to a virtual machine or remote desktop may exploit this issue to trigger a denial-of-service condition in the Thinprint service running on the host machine where VMware Workstation or Horizon Client for Windows is installed. VMware Workstation (versiones 16.x anteriores a 16.2.2) y Horizon Client para Windows (versiones 5.x anteriores a 5.5.3) contienen una vulnerabilidad de denegación de servicio en el componente Cortado ThinPrint. El problema se presenta en el analizador de fuentes TrueType. • https://www.vmware.com/security/advisories/VMSA-2022-0002.html •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-22060 – springframework: Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096)
https://notcve.org/view.php?id=CVE-2021-22060
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase. En Spring Framework versiones 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, y en las versiones anteriores no soportadas, es posible que un usuario proporcione una entrada maliciosa que cause una inserción de entradas de registro adicionales. Se trata de un seguimiento de CVE-2021-22096 que protege contra tipos adicionales de entrada y en más lugares de la base de código de Spring Framework • https://tanzu.vmware.com/security/cve-2021-22060 https://www.oracle.com/security-alerts/cpuapr2022.html https://access.redhat.com/security/cve/CVE-2021-22060 https://bugzilla.redhat.com/show_bug.cgi?id=2055480 •
CVSS: 7.8EPSS: 0%CPEs: 218EXPL: 0CVE-2021-22045 – VMware Workstation SCSI Heap-based Buffer Overflow Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-22045
VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine. VMware ESXi (versiones 7.0, 6.7 anteriores a ESXi670-202111101-SG y 6.5 anteriores a ESXi650-202110101-SG), VMware Workstation (versión 16.2.0) y VMware Fusion (versión 12.2.0), contienen una vulnerabilidad de desbordamiento de pila en la emulación de dispositivos de CD-ROM. Un actor malicioso con acceso a una máquina virtual con emulación de dispositivo de CD-ROM puede ser capaz de explotar esta vulnerabilidad en conjunto con otros problemas para ejecutar código en el hipervisor desde una máquina virtual This vulnerability allows local attackers to escalate privileges on affected installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the SCSI component. • http://packetstormsecurity.com/files/165440/VMware-Security-Advisory-2022-0001.html https://www.vmware.com/security/advisories/VMSA-2022-0001.html https://www.zerodayinitiative.com/advisories/ZDI-22-003 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2021-22056
https://notcve.org/view.php?id=CVE-2021-22056
VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability. A malicious actor with network access may be able to make HTTP requests to arbitrary origins and read the full response. VMware Workspace ONE Access versiones 21.08, 20.10.0.1 y 20.10 y Identity Manager versiones 3.3.5, 3.3.4 y 3.3.3, contienen una vulnerabilidad de tipo SSRF. Un actor malicioso con acceso a la red puede ser capaz de realizar peticiones HTTP a orígenes arbitrarios y leer la respuesta completa • https://www.vmware.com/security/advisories/VMSA-2021-0030.html • CWE-918: Server-Side Request Forgery (SSRF) •