VMware vCenter Server
14 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-38813 | 8.0 – < 8.0 U3b ; 7.0 – < 7.0 U3s | Privilege escalation vulnerability | CRITICAL 9.8 | 17 % | KEV | |
| CVE-2024-38812 | 8.0 – < 8.0 U3b ; 7.0 – < 7.0 U3s | Heap-overflow vulnerability | CRITICAL 9.8 | 55 % | KEV | |
| CVE-2024-37081 | 8.0 – < 8.0 U2d ; 7.0 – < 7.0 U3r | The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user | HIGH 7.8 | 5.0 % | ||
| CVE-2024-37080 | 8.0 – < 8.0 U2d ; 8.0 – < 8.0 U1e ; 7.0 – < 7.0 U3r | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to | CRITICAL 9.8 | 12 % | ||
| CVE-2024-37079 | 8.0 – < 8.0 U2d ; 8.0 – < 8.0 U1e ; 7.0 – < 7.0 U3r | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to | CRITICAL 9.8 | 22 % | KEV | |
| CVE-2024-22275 | 8.0 – < 8.0 U2b ; 7.0 – < 7.0 U3q | The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance she | MEDIUM 4.9 | 1.0 % | ||
| CVE-2024-22274 | 8.0 – < 8.0 U2b ; 7.0 – < 7.0 U3q | The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vC | HIGH 7.2 | 2.5 % | ||
| CVE-2022-31680 | VMware vCenter Server 6.5 prior to U3u | The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin | CRITICAL 9.1 | 31 % | ||
| CVE-2022-22982 | VMware vCenter Server (7.0 before 7.0 U3f, 6.7 before 6.7 U3r & 6.5 before 6.5 U3t) | The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter | HIGH 7.5 | 1.0 % | ||
| CVE-2021-22013 | VMware vCenter Server 6.5 before 6.5 U3q | The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicio | HIGH 7.5 | 1.7 % | ||
| CVE-2021-22012 | VMware vCenter Server 6.5 before 6.5 U3q | The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor wi | HIGH 7.5 | 1.4 % | ||
| CVE-2021-21972 | 7.x before 7.0 U1c ; 6.7 before 6.7 U3l ; 6.5 before 6.5 U3n | The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2021-21973 | 7.x before 7.0 U1c ; 6.7 before 6.7 U3l ; 6.5 before 6.5 U3n | The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Serv | MEDIUM 5.3 | 88 % | KEV | |
| CVE-2020-3952 | vCenter Server 6.7 (embedded or external PSC) prior to 6.7u3f is affected by CVE-2020-3952 if it was upgraded from a previous release line such as 6.0 or 6.5. Clean installations of vCenter Server 6.7 (embedded or external PSC) are not affected. | Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC) | CRITICAL 9.8 | 90 % | KEV |