Filtered by vendor Vmware Subscriptions
Filtered by product Vcenter Server Subscriptions
Total 75 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2009-2416 11 Apple, Canonical, Debian and 8 more 19 Iphone Os, Mac Os X, Mac Os X Server and 16 more 2025-04-09 6.5 Medium
Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.
CVE-2009-2698 6 Canonical, Fedoraproject, Linux and 3 more 14 Ubuntu Linux, Fedora, Linux Kernel and 11 more 2025-04-09 7.8 High
The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.
CVE-2009-1072 8 Canonical, Debian, Linux and 5 more 14 Ubuntu Linux, Debian Linux, Linux Kernel and 11 more 2025-04-09 N/A
nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option.
CVE-2021-21972 1 Vmware 2 Cloud Foundation, Vcenter Server 2025-04-03 9.8 Critical
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
CVE-2021-22017 1 Vmware 1 Vcenter Server 2025-04-02 5.3 Medium
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
CVE-2021-22005 1 Vmware 2 Cloud Foundation, Vcenter Server 2025-04-02 9.8 Critical
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
CVE-2021-21985 1 Vmware 2 Cloud Foundation, Vcenter Server 2025-04-02 9.8 Critical
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
CVE-2021-21973 1 Vmware 2 Cloud Foundation, Vcenter Server 2025-03-28 5.3 Medium
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
CVE-2024-37079 2 Broadcom, Vmware 4 Vmware Cloud Foundation, Vmware Vcenter Server, Cloud Foundation and 1 more 2025-03-14 9.8 Critical
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
CVE-2020-3952 1 Vmware 1 Vcenter Server 2025-03-13 9.8 Critical
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
CVE-2024-37080 1 Vmware 2 Cloud Foundation, Vcenter Server 2025-03-13 9.8 Critical
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
CVE-2023-20896 1 Vmware 1 Vcenter Server 2025-02-13 5.9 Medium
The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds read by sending a specially crafted packet leading to denial-of-service of certain services (vmcad, vmdird, and vmafdd).
CVE-2023-20895 1 Vmware 1 Vcenter Server 2025-02-13 8.1 High
The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication.
CVE-2023-20894 1 Vmware 1 Vcenter Server 2025-02-13 8.1 High
The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to memory corruption.
CVE-2023-20893 1 Vmware 1 Vcenter Server 2025-02-13 8.1 High
The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server.
CVE-2023-20892 1 Vmware 1 Vcenter Server 2025-02-13 8.1 High
The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server.
CVE-2022-22948 1 Vmware 2 Cloud Foundation, Vcenter Server 2025-02-10 6.5 Medium
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.
CVE-2023-34048 1 Vmware 1 Vcenter Server 2024-12-20 9.8 Critical
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
CVE-2024-38812 2 Broadcom, Vmware 3 Vmware Cloud Foundation, Vmware Vcenter Server, Vcenter Server 2024-11-22 9.8 Critical
The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
CVE-2024-38813 2 Broadcom, Vmware 3 Vmware Center Server, Vmware Cloud Foundation, Vcenter Server 2024-11-22 7.5 High
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.