Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
93 results · page 1 of 2
May 20, 2025VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation.CVE-2025-41228 · Other software · VMware · reported by security@vmware.comMedium 4.3
VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal cookies or redirect to malicious websites.
- Product
- vCenter Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025The vCenter Server contains an authenticated command-execution vulnerability.CVE-2025-41225 · Other software · VMware · reported by security@vmware.comHigh 8.8
The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.
- Product
- vCenter Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2024VMware vCenter Server Privilege Escalation VulnerabilityCVE-2024-38813 · Other software · VMware · reported by security@vmware.comExploitedHigh 7.5
VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.
- Product
- vCenter Server
- On CISA’s list since
- Nov 20, 2024 (federal fix deadline Dec 11, 2024)
- What to do
- Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.broadcom.comcisa.gov
Sep 17, 2024VMware vCenter Server Heap-Based Buffer Overflow VulnerabilityCVE-2024-38812 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.8
VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.
- Product
- vCenter Server
- On CISA’s list since
- Nov 20, 2024 (federal fix deadline Dec 11, 2024)
- What to do
- Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.broadcom.comcisa.gov
Jun 25, 2024The vCenter Server contains a denial-of-service vulnerability.CVE-2024-37087 · Other software · VMware · reported by security@vmware.comMedium 5.3
The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comsupport.broadcom.com
Jun 18, 2024The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo.CVE-2024-37081 · Other software · vmware · reported by security@vmware.comHigh 7.8
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.
- Product
- cloud_foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comsupport.broadcom.com
Jun 18, 2024vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.CVE-2024-37080 · Other software · vmware · reported by security@vmware.comCritical 9.8
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
- Product
- cloud_foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comsupport.broadcom.com
Jun 18, 2024Broadcom VMware vCenter Server Out-of-bounds Write VulnerabilityCVE-2024-37079 · Other software · Broadcom · reported by security@vmware.comExploitedCritical 9.8
Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.
- Product
- VMware vCenter Server
- On CISA’s list since
- Jan 23, 2026 (federal fix deadline Feb 13, 2026)
- What to do
- Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.broadcom.comsupport.broadcom.com
May 21, 2024The vCenter Server contains a partial file read vulnerability.CVE-2024-22275 · Other software · VMware · reported by security@vmware.comMedium 4.9
The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially read arbitrary files containing sensitive data.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comsupport.broadcom.com
May 21, 2024The vCenter Server contains an authenticated remote code execution vulnerability.CVE-2024-22274 · Other software · broadcom · reported by security@vmware.comHigh 7.2
The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system.
- Product
- vmware_center_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.broadcom.comsupport.broadcom.com
Oct 25, 2023vCenter Server contains a partial information disclosure vulnerability.CVE-2023-34056 · Other software · VMware · reported by security@vmware.comMedium 4.3
vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data.
- Product
- VMware vCenter Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023VMware vCenter Server Out-of-Bounds Write VulnerabilityCVE-2023-34048 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.8
VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution.
- Product
- vCenter Server
- On CISA’s list since
- Jan 22, 2024 (federal fix deadline Feb 12, 2024)
- What to do
- Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogvmware.comvicarius.io
Jun 22, 2023The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol.CVE-2023-20896 · Other software · VMware · reported by security@vmware.comMedium 5.9
The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds read by sending a specially crafted packet leading to denial-of-service of certain services (vmcad, vmdird, and vmafdd).
- Product
- VMware vCenter Server (vCenter Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comvmware.com
Jun 22, 2023The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol.CVE-2023-20895 · Other software · VMware · reported by security@vmware.comHigh 8.1
The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication.
- Product
- VMware vCenter Server (vCenter Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comvmware.com
Jun 22, 2023The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol.CVE-2023-20894 · Other software · VMware · reported by security@vmware.comHigh 8.1
The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to memory corruption.
- Product
- VMware vCenter Server (vCenter Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comvmware.com
Jun 22, 2023The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol.CVE-2023-20893 · Other software · VMware · reported by security@vmware.comHigh 8.1
The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server.
- Product
- VMware vCenter Server (vCenter Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comvmware.com
Jun 22, 2023The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol.CVE-2023-20892 · Other software · VMware · reported by security@vmware.comHigh 8.1
The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server.
- Product
- VMware vCenter Server (vCenter Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comvmware.com
Dec 13, 2022The vCenter Server contains a denial-of-service vulnerability in the content library service.CVE-2022-31698 · Other software · VMware · reported by security@vmware.comMedium 5.3
The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to trigger a denial-of-service condition by sending a specially crafted header.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comvmware.com
Dec 13, 2022The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext.CVE-2022-31697 · Other software · VMware · reported by security@vmware.comMedium 5.5
The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with access to a workstation that invoked a vCenter Server Appliance ISO operation (Install/Upgrade/Migrate/Restore) can access plaintext passwords used during that operation.
- Product
- Vcenter Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller).CVE-2022-31680 · Other software · VMware · reported by security@vmware.comCritical 9.1
The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server.
- Product
- Vcenter Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comvmware.com
Jul 13, 2022The vCenter Server contains a server-side request forgery (SSRF) vulnerability.CVE-2022-22982 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2022VMware vCenter Server Incorrect Default File Permissions Vulnerability CVE-2022-22948 · Other software · VMware · reported by security@vmware.comExploitedMedium 6.5
VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.
- Product
- vCenter Server
- On CISA’s list since
- Jul 17, 2024 (federal fix deadline Aug 7, 2024)
- What to do
- Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogvmware.comvmware.com
Nov 24, 2021The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in.CVE-2021-22049 · Other software · VMware · reported by security@vmware.comCritical 9.8
The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.
- Product
- Vcenter Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism.CVE-2021-22048 · Other software · VMware · reported by security@vmware.comHigh 8.8
The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A malicious actor with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Sep 23, 2021The vCenter Server contains a denial-of-service vulnerability in the Analytics service.CVE-2021-22020 · Other software · VMware · reported by security@vmware.comMedium 5.5
The vCenter Server contains a denial-of-service vulnerability in the Analytics service. Successful exploitation of this issue may allow an attacker to create a denial-of-service condition on vCenter Server.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service.CVE-2021-22019 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 5480 on vCenter Server may exploit this issue by sending a specially crafted jsonrpc message to create a denial of service condition.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in.CVE-2021-22018 · Other software · VMware · reported by security@vmware.comMedium 6.5
The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A malicious actor with network access to port 9087 on vCenter Server may exploit this issue to delete non critical files.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021VMware vCenter Server Improper Access ControlCVE-2021-22017 · Other software · VMware · reported by security@vmware.comExploitedMedium 5.3
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
- Product
- vCenter Server
- On CISA’s list since
- Jan 10, 2022 (federal fix deadline Jan 24, 2022)
- What to do
- Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogvmware.comvmware.com
Sep 23, 2021The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization.CVE-2021-22016 · Other software · VMware · reported by security@vmware.comMedium 6.1
The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit this issue to execute malicious scripts by tricking a victim into clicking a malicious link.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories.CVE-2021-22015 · Other software · VMware · reported by security@vmware.comHigh 7.8
The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvmware.com
Sep 23, 2021The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure).CVE-2021-22014 · Other software · VMware · reported by security@vmware.comHigh 7.2
The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). An authenticated VAMI user with network access to port 5480 on vCenter Server may exploit this issue to execute code on the underlying operating system that hosts vCenter Server.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API.CVE-2021-22013 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API.CVE-2021-22012 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library.CVE-2021-22011 · Other software · VMware · reported by security@vmware.comMedium 5.3
vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to perform unauthenticated VM network setting manipulation.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains a denial-of-service vulnerability in VPXD service.CVE-2021-22010 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to create a denial of service condition due to excessive memory consumption by VPXD service.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service.CVE-2021-22009 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit these issues to create a denial of service condition due to excessive memory consumption by VAPI service.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service.CVE-2021-22008 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by sending a specially crafted json-rpc message to gain access to sensitive information.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains a local information disclosure vulnerability in the Analytics service.CVE-2021-22007 · Other software · VMware · reported by security@vmware.comMedium 5.5
The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administrative privilege may exploit this issue to gain access to sensitive information.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI.CVE-2021-22006 · Other software · VMware · reported by security@vmware.comHigh 7.5
The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to access restricted endpoints.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021VMware vCenter Server File Upload VulnerabilityCVE-2021-22005 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
- Product
- vCenter Server
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline Nov 17, 2021)
- What to do
- Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comvmware.com
Sep 23, 2021The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content Library.CVE-2021-21993 · Other software · VMware · reported by security@vmware.comMedium 6.5
The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content Library. An authorised user with access to content library may exploit this issue by sending a POST request to vCenter Server leading to information disclosure.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2021The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing.CVE-2021-21992 · Other software · VMware · reported by security@vmware.comMedium 6.5
The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing. A malicious actor with non-administrative user access to the vCenter Server vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash) may exploit this issue to create a denial-of-service condition on the vCenter Server host.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2021The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens.CVE-2021-21991 · Other software · VMware · reported by security@vmware.comHigh 7.8
The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens. A malicious actor with non-administrative user access on vCenter Server host may exploit this issue to escalate privileges to Administrator on the vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash).
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2021The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle ManCVE-2021-21986 · Other software · VMware · reported by security@vmware.comCritical 9.8
The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A malicious actor with network access to port 443 on vCenter Server may perform actions allowed by the impacted plug-ins without authentication.
- Product
- Vcenter Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvmware.com
May 26, 2021VMware vCenter Server Improper Input Validation VulnerabilityCVE-2021-21985 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.
- Product
- vCenter Server
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline Nov 17, 2021)
- What to do
- Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Mar 15, 2021Element Plug-in for vCenter Server incorporates SpringBoot Framework.CVE-2021-26987 · Other software · VMware · reported by security-alert@netapp.comCritical 9.8
Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Remote Code Execution. All versions of Element Plug-in for vCenter Server, Management Services versions prior to 2.17.56 and Management Node versions through 12.2 contain vulnerable versions of SpringBoot Framework.
- Product
- Spring Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com
Feb 24, 2021VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) VulnerabilityCVE-2021-21973 · Other software · VMware · reported by security@vmware.comExploitedMedium 5.3
VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.
- Product
- vCenter Server and Cloud Foundation
- On CISA’s list since
- Mar 7, 2022 (federal fix deadline Mar 21, 2022)
- What to do
- Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogvmware.comvmware.com
Feb 24, 2021VMware vCenter Server Remote Code Execution VulnerabilityCVE-2021-21972 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.
- Product
- vCenter Server
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline Nov 17, 2021)
- What to do
- Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Oct 20, 2020VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update CVE-2020-3994 · Other software · VMware · reported by security@vmware.comHigh 7.4
VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update function due to a lack of certificate validation. A malicious actor with network positioning between vCenter Server and an update repository may be able to perform a session hijack when the vCenter Server Appliance Management Interface is used to download vCenter updates.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2020VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services.CVE-2020-3976 · Other software · VMware · reported by security@vmware.comMedium 5.3
VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.