Filtered by vendor Vmware Subscriptions
Total 991 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-22965 6 Cisco, Oracle, Redhat and 3 more 45 Cx Cloud Agent, Commerce Platform, Communications Cloud Native Core Automated Test Suite and 42 more 2025-10-30 9.8 Critical
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2024-37085 1 Vmware 2 Cloud Foundation, Esxi 2025-10-30 6.8 Medium
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
CVE-2023-34048 1 Vmware 2 Cloud Foundation, Vcenter Server 2025-10-30 9.8 Critical
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
CVE-2019-5544 4 Fedoraproject, Openslp, Redhat and 1 more 17 Fedora, Openslp, Enterprise Linux and 14 more 2025-10-30 9.8 Critical
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
CVE-2023-20867 4 Debian, Fedoraproject, Redhat and 1 more 8 Debian Linux, Fedora, Enterprise Linux and 5 more 2025-10-28 3.9 Low
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
CVE-2023-20887 1 Vmware 1 Aria Operations For Networks 2025-10-28 9.8 Critical
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
CVE-2025-58126 3 Checkmk, Tomtretbar, Vmware 3 Checkmk, Vmware Vsan, Vma 2025-09-23 4.8 Medium
Improper Certificate Validation in Checkmk Exchange plugin VMware vSAN allows attackers in MitM position to intercept traffic.
CVE-2019-11272 3 Debian, Redhat, Vmware 3 Debian Linux, Jboss Fuse, Spring Security 2025-09-12 7.3 High
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".
CVE-2022-31674 1 Vmware 1 Vrealize Operations 2025-08-27 4.3 Medium
VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can access log files that lead to information disclosure.
CVE-2022-31672 1 Vmware 1 Vrealize Operations 2025-08-27 6.4 Medium
VMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate privileges to root.
CVE-2024-22255 2 Apple, Vmware 5 Macos, Cloud Foundation, Esxi and 2 more 2025-08-26 7.1 High
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process.  
CVE-2020-3993 2 Broadcom, Vmware 2 Vmware Nsx-t Data Center, Cloud Foundation 2025-08-13 5.9 Medium
VMware NSX-T (3.x before 3.0.2, 2.5.x before 2.5.2.2.0) contains a security vulnerability that exists in the way it allows a KVM host to download and install packages from NSX manager. A malicious actor with MITM positioning may be able to exploit this issue to compromise the transport node.
CVE-2020-3999 2 Apple, Vmware 4 Mac Os X, Esxi, Fusion and 1 more 2025-08-08 6.5 Medium
VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and VMware Cloud Foundation contain a denial of service vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of service condition.
CVE-2025-22243 2 Broadcom, Vmware 4 Vmware Nsx, Cloud Foundation, Telco Cloud Infrastructure and 1 more 2025-07-14 7.5 High
VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation.
CVE-2025-22244 2 Broadcom, Vmware 4 Vmware Nsx, Cloud Foundation, Telco Cloud Infrastructure and 1 more 2025-07-14 6.9 Medium
VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation.
CVE-2025-22245 2 Broadcom, Vmware 4 Vmware Nsx, Cloud Foundation, Telco Cloud Infrastructure and 1 more 2025-07-14 5.9 Medium
VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation.
CVE-2025-22249 1 Vmware 3 Aria Automation, Cloud Foundation, Telco Cloud Platform 2025-07-11 8.2 High
VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by tricking the user into clicking a malicious crafted payload URL.
CVE-2024-37087 1 Vmware 2 Cloud Foundation, Vcenter Server 2025-06-27 5.3 Medium
The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition.
CVE-2024-37086 1 Vmware 2 Cloud Foundation, Esxi 2025-06-27 6.8 Medium
VMware ESXi contains an out-of-bounds read vulnerability. A malicious actor with local administrative privileges on a virtual machine with an existing snapshot may trigger an out-of-bounds read leading to a denial-of-service condition of the host.
CVE-2024-22275 1 Vmware 2 Cloud Foundation, Vcenter Server 2025-06-27 4.9 Medium
The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially read arbitrary files containing sensitive data.