CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22271 – Spring Cloud Function Web DOS Vulnerability
https://notcve.org/view.php?id=CVE-2024-22271
09 Jul 2024 — In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions. Specifically, an application is vulnerable when all of the following are true: User is using Spring Cloud Function Web module Affected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8 References https://spring.io/security/cve-2022-22979 https://checkmarx.com/blog/spring-... • https://spring.io/security/cve-2024-22271 • CWE-20: Improper Input Validation •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22277
https://notcve.org/view.php?id=CVE-2024-22277
04 Jul 2024 — VMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor with network access to VMware Cloud Director Availability can craft malicious HTML tags to execute within replication tasks. • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24557 • CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22260
https://notcve.org/view.php?id=CVE-2024-22260
27 Jun 2024 — VMware Workspace One UEM update addresses an information exposure vulnerability. A malicious actor with network access to the Workspace One UEM may be able to perform an attack resulting in an information exposure. • https://www.vmware.com/security/advisories/OMSA-2024-0001.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-37086
https://notcve.org/view.php?id=CVE-2024-37086
25 Jun 2024 — VMware ESXi contains an out-of-bounds read vulnerability. A malicious actor with local administrative privileges on a virtual machine with an existing snapshot may trigger an out-of-bounds read leading to a denial-of-service condition of the host. VMware ESXi contains an out-of-bounds read vulnerability. A malicious actor with local administrative privileges on a virtual machine with an existing snapshot may trigger an out-of-bounds read leading to a denial-of-service condition of the host. • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505 • CWE-125: Out-of-bounds Read •
CVSS: 8.3EPSS: 59%CPEs: 2EXPL: 3CVE-2024-37085 – VMware ESXi Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2024-37085
25 Jun 2024 — VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD. VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active... • https://github.com/mahmutaymahmutay/CVE-2024-37085 • CWE-305: Authentication Bypass by Primary Weakness •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-37087 – VMware vCenter Server Appliance License Server Uncontrolled Memory Allocation Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2024-37087
25 Jun 2024 — The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of VMware vCenter Server Appliance. Authentication is not required to exploit this vulnerability. The specific flaw exists within the License Server. The issue results from the lack of proper validation of user-supplied data, which can result... • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 8.8EPSS: 72%CPEs: 1EXPL: 1CVE-2024-22263 – Arbitrary File Write Vulnerability in Spring Cloud Data Flow
https://notcve.org/view.php?id=CVE-2024-22263
19 Jun 2024 — Spring Cloud Data Flow is a microservices-based Streaming and Batch data processing in Cloud Foundry and Kubernetes. The Skipper server has the ability to receive upload package requests. However, due to improper sanitization for upload path, a malicious user who has access to skipper server api can use a crafted upload request to write arbitrary file to any location on file system, may even compromises the server. Spring Cloud Data Flow es un procesamiento de datos por lotes y streaming basado en microserv... • https://github.com/securelayer7/CVE-2024-22263_Scanner • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 10.0EPSS: 48%CPEs: 2EXPL: 6CVE-2024-37081 – vCenter Sudo Privilege Escalation
https://notcve.org/view.php?id=CVE-2024-37081
18 Jun 2024 — The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance. vCenter Server contiene múltiples vulnerabilidades de escalada de privilegios locales debido a una mala configuración de sudo. Un usuario local autenticado con privilegios no administrativos puede aprovechar estos problemas para elevar los privilegios ... • https://packetstorm.news/files/id/182981 • CWE-556: ASP.NET Misconfiguration: Use of Identity Impersonation •
CVSS: 10.0EPSS: 43%CPEs: 2EXPL: 0CVE-2024-37080
https://notcve.org/view.php?id=CVE-2024-37080
18 Jun 2024 — vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution. vCenter Server contiene una vulnerabilidad de desbordamiento de montón en la implementación del protocolo DCERPC. Un actor malintencionado con acceso a la red de vCenter Server puede desencadenar esta vulnerabilidad al enviar un paqu... • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453 • CWE-122: Heap-based Buffer Overflow •
CVSS: 10.0EPSS: 47%CPEs: 3EXPL: 0CVE-2024-37079
https://notcve.org/view.php?id=CVE-2024-37079
18 Jun 2024 — vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution. vCenter Server contiene una vulnerabilidad de desbordamiento de montón en la implementación del protocolo DCERPC. Un actor malintencionado con acceso a la red de vCenter Server puede desencadenar esta vulnerabilidad al enviar un paqu... • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453 • CWE-787: Out-of-bounds Write •