58.465 CVE seguite
793 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
Vulnerabilità VMware
1041 CVE
| Identificativo | Gravità, ordina dal più alto | Prodotto e difetto | EPSS, ordinato dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2021-22005 | CRIT 9.8 | ransomware vmware cloud_foundation The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file. | 100,0% | |
| CVE-2021-21985 | CRIT 9.8 | ransomware vmware cloud_foundation The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this | 100,0% | |
| CVE-2014-6271 | CRIT 9.8 | apple mac_os_x GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature | 100,0% | |
| CVE-2022-22954 | CRIT 9.8 | ransomware vmware cloud_foundation VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution. | 100,0% | |
| CVE-2014-7169 | CRIT 9.8 | apple mac_os_x GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as | 99,9% | |
| CVE-2022-22963 | CRIT 9.8 | oracle banking_branch In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local r | 99,9% | |
| CVE-2021-21972 | CRIT 9.8 | ransomware vmware cloud_foundation The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system t | 99,9% | |
| CVE-2021-22054 | HIGH 7.5 | vmware workspace_one_uem_console VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their req | 99,7% | |
| CVE-2022-22965 | CRIT 9.8 | cisco cx_cloud_agent A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot | 99,6% | |
| CVE-2023-34048 | CRIT 9.8 | vmware vcenter_server vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution. | 99,4% | |
| CVE-2021-21978 | CRIT 9.8 | vmware view_planner VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attacker with network acces | 99,0% | — |
| CVE-2023-20887 | CRIT 9.8 | vmware aria_operations_for_networks Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution. | 98,3% | |
| CVE-2022-22947 | CRIT 10.0 | oracle commerce_guided_search In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could all | 98,3% | |
| CVE-2019-5544 | CRIT 9.8 | ransomware fedoraproject fedora OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. | 97,3% | |
| CVE-2018-1273 | CRIT 9.8 | ransomware apache ignite Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supp | 97,0% | |
| CVE-2020-11651 | CRIT 9.8 | canonical ubuntu_linux An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be us | 96,6% | |
| CVE-2020-5410 | HIGH 7.5 | vmware spring_cloud_config Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a | 95,6% | |
| CVE-2017-5753 | MED 5.6 | arm cortex-a12_firmware Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. | 93,8% | — |
| CVE-2014-0054 | MED 6.8 | springsource spring_framework The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attac | 91,4% | — |
| CVE-2013-6429 | MED 6.8 | pivotal_software spring_framework The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks | 90,6% | — |
| CVE-2020-3952 | CRIT 9.8 | vmware vcenter_server Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls. | 90,4% | |
| CVE-2015-2342 | HIGH 10.0 | vmware vcenter_server The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol. | 89,0% | — |
| CVE-2020-5398 | HIGH 7.5 | netapp data_availability_services In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the | 88,8% | — |
| CVE-2021-21973 | MED 5.3 | vmware cloud_foundation The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter | 87,6% | |
| CVE-2022-31706 | CRIT 9.8 | vmware vrealize_log_insight The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution. | 87,1% | — |