CVSS: 8.2EPSS: 0%CPEs: 22EXPL: 0CVE-2022-31705
https://notcve.org/view.php?id=CVE-2022-31705
VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed. VMware ESXi, Workstation y Fusion contienen una vulnerabilidad de escritura fuera de los límites en el controlador USB 2.0 (EHCI). Un actor malintencionado con privilegios administrativos locales en una máquina virtual puede aprovechar este problema para ejecutar código como el proceso VMX de la máquina virtual que se ejecuta en el host. • https://www.vmware.com/security/advisories/VMSA-2022-0033.html • CWE-787: Out-of-bounds Write •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2022-22983
https://notcve.org/view.php?id=CVE-2022-22983
VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability. A malicious actor with local user privileges to the victim machine may exploit this vulnerability leading to the disclosure of user passwords of the remote server connected through VMware Workstation. VMware Workstation (versiones 16.x anteriores a 16.2.4) contiene una vulnerabilidad de almacenamiento de credenciales sin protección. Un actor malicioso con privilegios de usuario local en la máquina víctima puede explotar esta vulnerabilidad conllevando a una divulgación de contraseñas de usuario del servidor remoto conectado mediante VMware Workstation • https://www.vmware.com/security/advisories/VMSA-2022-0023.html • CWE-522: Insufficiently Protected Credentials •
CVSS: 6.7EPSS: 0%CPEs: 171EXPL: 0CVE-2021-22041
https://notcve.org/view.php?id=CVE-2021-22041
VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. VMware ESXi, Workstation y Fusion contienen una vulnerabilidad de doble búsqueda en el controlador USB UHCI. Un actor malicioso con privilegios administrativos locales en una máquina virtual puede aprovechar este problema para ejecutar código como el proceso VMX de la máquina virtual que es ejecutada en el host • https://www.vmware.com/security/advisories/VMSA-2022-0004.html •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-22938
https://notcve.org/view.php?id=CVE-2022-22938
VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueType font parser. A malicious actor with access to a virtual machine or remote desktop may exploit this issue to trigger a denial-of-service condition in the Thinprint service running on the host machine where VMware Workstation or Horizon Client for Windows is installed. VMware Workstation (versiones 16.x anteriores a 16.2.2) y Horizon Client para Windows (versiones 5.x anteriores a 5.5.3) contienen una vulnerabilidad de denegación de servicio en el componente Cortado ThinPrint. El problema se presenta en el analizador de fuentes TrueType. • https://www.vmware.com/security/advisories/VMSA-2022-0002.html •
CVSS: 7.8EPSS: 0%CPEs: 218EXPL: 0CVE-2021-22045 – VMware Workstation SCSI Heap-based Buffer Overflow Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-22045
VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine. VMware ESXi (versiones 7.0, 6.7 anteriores a ESXi670-202111101-SG y 6.5 anteriores a ESXi650-202110101-SG), VMware Workstation (versión 16.2.0) y VMware Fusion (versión 12.2.0), contienen una vulnerabilidad de desbordamiento de pila en la emulación de dispositivos de CD-ROM. Un actor malicioso con acceso a una máquina virtual con emulación de dispositivo de CD-ROM puede ser capaz de explotar esta vulnerabilidad en conjunto con otros problemas para ejecutar código en el hipervisor desde una máquina virtual This vulnerability allows local attackers to escalate privileges on affected installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the SCSI component. • http://packetstormsecurity.com/files/165440/VMware-Security-Advisory-2022-0001.html https://www.vmware.com/security/advisories/VMSA-2022-0001.html https://www.zerodayinitiative.com/advisories/ZDI-22-003 • CWE-787: Out-of-bounds Write •