CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2021-22019 – VMware vCenter Server Appliance External Control of File Path Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2021-22019
22 Sep 2021 — The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 5480 on vCenter Server may exploit this issue by sending a specially crafted jsonrpc message to create a denial of service condition. vCenter Server contiene una vulnerabilidad de denegación de servicio en el servicio VAPI (vCenter API). Un actor malicioso con acceso a la red al puerto 5480 en vCenter Server puede explotar este problema mediante el envío de un mensaje js... • https://www.vmware.com/security/advisories/VMSA-2021-0020.html •
CVSS: 7.8EPSS: 2%CPEs: 4EXPL: 3CVE-2021-22015 – VMware vCenter Server Appliance Incorrect Permission Assignment Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-22015
22 Sep 2021 — The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance. vCenter Server contiene múltiples vulnerabilidades de escalada de privilegios locales debido a permisos inapropiados de archivos y directorios. Un usuario local autenticado con privilegios no administrativos puede explotar est... • https://packetstorm.news/files/id/170116 • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 7.5EPSS: 0%CPEs: 17EXPL: 0CVE-2021-22003
https://notcve.org/view.php?id=CVE-2021-22003
31 Aug 2021 — VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and password complexity for the target account. VMware Workspace ONE Access y Identity Manager, proporcionan sin intención una interfaz de inicio de sesión en el puerto 7443. Un actor malicioso con acceso a la red al pu... • https://www.vmware.com/security/advisories/VMSA-2021-0016.html • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 9.8EPSS: 0%CPEs: 17EXPL: 0CVE-2021-22002
https://notcve.org/view.php?id=CVE-2021-22002
31 Aug 2021 — VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in addition a malicious actor could access /cfg diagnostic endpoints without authentication. VMware Workspace ONE Access y Identity Manager, permiten el acceso a la aplicación web /cfg y a los endpoints de diagnóstico, e... • https://www.vmware.com/security/advisories/VMSA-2021-0016.html • CWE-287: Improper Authentication •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2021-22021
https://notcve.org/view.php?id=CVE-2021-22021
30 Aug 2021 — VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. An attacker with user privileges may be able to inject a malicious payload via the Log Insight UI which would be executed when the victim accesses the shared dashboard link. VMware vRealize Log Insight (versiones 8.x anteriores a 8.4) contiene una vulnerabilidad de tipo Cross Site Scripting (XSS) debido a una comprobación inapropiada de la entrada del usuario. Un atacante... • https://www.vmware.com/security/advisories/VMSA-2021-0019.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2021-22025
https://notcve.org/view.php?id=CVE-2021-22025
30 Aug 2021 — The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can add new nodes to existing vROps cluster. La API de vRealize Operations Manager (versiones 8.x anteriores a 8.5) contiene una vulnerabilidad de control de acceso rota, conllevando a un acceso no autenticado a la API. Un actor malicioso no autenticado con acceso a la red de ... • https://www.vmware.com/security/advisories/VMSA-2021-0018.html • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2021-22026
https://notcve.org/view.php?id=CVE-2021-22026
30 Aug 2021 — The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leading to information disclosure. La API de vRealize Operations Manager (versiones 8.x anteriores a 8.5) contiene una vulnerabilidad de tipo Server Side Request Forgery en un endpoint. Un actor malicioso no autenticado con acceso a la red de la API de vReal... • https://www.vmware.com/security/advisories/VMSA-2021-0018.html • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2021-22027
https://notcve.org/view.php?id=CVE-2021-22027
30 Aug 2021 — The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leading to information disclosure. La API de vRealize Operations Manager (versiones 8.x anteriores a 8.5) contiene una falsificación de petición del lado del servidor en un endpoint. Un actor malicioso no autenticado con acceso a la red a la API de vRealize ... • https://www.vmware.com/security/advisories/VMSA-2021-0018.html • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2021-22024
https://notcve.org/view.php?id=CVE-2021-22024
30 Aug 2021 — The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can read any log file resulting in sensitive information disclosure. La API de vRealize Operations Manager (versiones 8.x anteriores a 8.5) contiene una vulnerabilidad de lectura arbitraria de archivos de registro. Un actor malicioso no autenticado con acceso a la red de la API de vRealize Operations Manager pu... • https://www.vmware.com/security/advisories/VMSA-2021-0018.html • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.2EPSS: 0%CPEs: 5EXPL: 0CVE-2021-22023
https://notcve.org/view.php?id=CVE-2021-22023
30 Aug 2021 — The vRealize Operations Manager API (8.x prior to 8.5) has insecure object reference vulnerability. A malicious actor with administrative access to vRealize Operations Manager API may be able to modify other users information leading to an account takeover. La API de vRealize Operations Manager (versiones 8.x anteriores a 8.5) presenta una vulnerabilidad de referencia a objetos inseguros. Un actor malicioso con acceso administrativo a la API de vRealize Operations Manager puede ser capaz de modificar la inf... • https://www.vmware.com/security/advisories/VMSA-2021-0018.html • CWE-639: Authorization Bypass Through User-Controlled Key •