58.414 CVE tracked
792 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
58.414 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2021-22054 | HIGH 7.5 | vmware workspace_one_uem_console VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their req | 97.4% | |
| CVE-2021-22050 | HIGH 7.5 | vmware cloud_foundation ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. A malicious actor with network access to ESXi may exploit this issue to create a denial-of-service condition by overwhelming rhttpproxy service with multiple requests. | 2.3% | — |
| CVE-2021-22044 | HIGH 7.5 | vmware spring_cloud_openfeign In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level `@RequestMapping`annotations over Feign client interfaces, can be involuntarily exposing endpoints corresponding to `@Reques | 1.1% | — |
| CVE-2021-22043 | HIGH 7.5 | vmware esxi VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled. A malicious actor with access to settingsd, may exploit this issue to escalate their privileges by writing arbitrary files. | 1.1% | — |
| CVE-2021-22034 | HIGH 7.5 | vmware vrealize_operations_tenant Releases prior to VMware vRealize Operations Tenant App 8.6 contain an Information Disclosure Vulnerability. | 1.0% | — |
| CVE-2021-22029 | HIGH 7.5 | vmware workspace_one_uem_console VMware Workspace ONE UEM REST API contains a denial of service vulnerability. A malicious actor with access to /API/system/admins/session could cause an API denial of service due to improper rate limiting. | 1.0% | — |
| CVE-2021-22027 | HIGH 7.5 | vmware cloud_foundation The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leadin | 1.2% | — |
| CVE-2021-22026 | HIGH 7.5 | vmware cloud_foundation The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leadin | 1.1% | — |
| CVE-2021-22025 | HIGH 7.5 | vmware cloud_foundation The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can add new nodes to exis | 0.8% | — |
| CVE-2021-22024 | HIGH 7.5 | vmware cloud_foundation The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can read any log file resulting in sensitive information dis | 1.0% | — |
| CVE-2021-22019 | HIGH 7.5 | vmware cloud_foundation The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 5480 on vCenter Server may exploit this issue by sending a specially crafted jsonrpc message to create a denial of servic | 1.6% | — |
| CVE-2021-22013 | HIGH 7.5 | vmware cloud_foundation The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive informatio | 1.7% | — |
| CVE-2021-22012 | HIGH 7.5 | vmware cloud_foundation The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information. | 1.4% | — |
| CVE-2021-22010 | HIGH 7.5 | vmware cloud_foundation The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to create a denial of service condition due to excessive memory consumption by VPXD servic | 1.6% | — |
| CVE-2021-22009 | HIGH 7.5 | vmware cloud_foundation The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit these issues to create a denial of service condition due to excessive memory c | 1.4% | — |
| CVE-2021-22008 | HIGH 7.5 | vmware cloud_foundation The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by sending a specially crafted json-rpc message to gain access to sens | 1.7% | — |
| CVE-2021-22006 | HIGH 7.5 | vmware cloud_foundation The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to access restricted endpoints. | 6.4% | — |
| CVE-2021-22003 | HIGH 7.5 | vmware cloud_foundation VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based | 1.0% | — |
| CVE-2021-21995 | HIGH 7.5 | vmware cloud_foundation OpenSLP as used in ESXi has a denial-of-service vulnerability due a heap out-of-bounds read issue. A malicious actor with network access to port 427 on ESXi may be able to trigger a heap out-of-bounds read in OpenSLP service resulting in a denial-of-service co | 1.0% | — |
| CVE-2021-21980 | HIGH 7.5 | vmware cloud_foundation The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information. | 4.7% | — |
| CVE-2021-21975 | HIGH 7.5 | ransomware vmware cloud_foundation Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credent | 78.3% | |
| CVE-2021-21501 | HIGH 7.5 | apache servicecomb Improper configuration will cause ServiceComb ServiceCenter Directory Traversal problem in ServcieCenter 1.x.x versions and fixed in 2.0.0. | 4.4% | — |
| CVE-2021-21341 | HIGH 7.5 | apache activemq XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such | 77.8% | — |
| CVE-2021-20442 | HIGH 7.5 | ibm security_verify_bridge IBM Security Verify Bridge contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 196618. | 1.0% | — |
| CVE-2021-20427 | HIGH 7.5 | ibm security_guardium IBM Security Guardium 11.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196314. | 1.3% | — |