ES
Virtualization
ESXi
On CISA KEVExploited in the wildRansomware-linked
138
CVEs
8
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 7High 39Medium 37Low 3
Watch
Add ESXi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-5519 | 6.8 | Apr 1 | VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14.x before 14.1.7), Fusion (11.x before… Affected: 6.0; 6.0; 6.0; 6.5; 6.5; 6.5; +34 more |
| CVE-2019-5518 | 6.8 | Apr 1 | VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14.x before 14.1.7), Fusion (11.x before… Affected: 6.0; 6.0; 6.0; 6.5; 6.5; 6.5; +34 more |
| CVE-2024-22253 | 6.7 | Mar 5 | VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +28 more |
| CVE-2024-22252 | 6.7 | Mar 5 | VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +28 more |
| CVE-2021-22041 | 6.7 | Feb 16 | VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller Affected: 6.5; 6.7; 6.7; 6.7; 6.7; 6.7; +34 more |
| CVE-2021-22040 | 6.7 | Feb 16 | VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller Affected: 6.5; 6.5; 6.7; 6.7; 6.7; 6.7; +34 more |
| CVE-2022-31681 | 6.5 | Oct 7 | VMware ESXi contains a null-pointer deference vulnerability Affected: VMware ESXi (7.0 prior to ESXi70U3sf-20036586, 6.7 prior to ESXi670-202210101-SG & 6.5 prior to ESXi650-202210101-SG) |
| CVE-2020-3999 | 6.5 | Dec 21 | VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and… Affected: 7.0; 7.0; 7.0; 7.0; 7.0 |
| CVE-2019-5536 | 6.5 | Oct 28 | VMware ESXi (6.7 before ESXi670-201908101-SG and 6.5 before ESXi650-201910401-SG), Workstation (15.x before 15.5.0) and Fusion (11.x before 11.5.0) contain a denial-of-service… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2018-6982 | 6.5 | Dec 4 | VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG contain uninitialized stack memory usage in the vmxnet3 virtual network adapter which… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2018-6977 | 6.5 | Oct 9 | VMware ESXi (6.7, 6.5, 6.0), Workstation (15.x and 14.x) and Fusion (11.x and 10.x) contain a denial-of-service vulnerability due to an infinite loop in a 3D-rendering shader Affected: 6.0; 6.5; 6.7 |
| CVE-2018-6972 | 6.5 | Jul 25 | VMware ESXi (6.7 before ESXi670-201806401-BG, 6.5 before ESXi650-201806401-BG, 6.0 before ESXi600-201806401-BG and 5.5 before ESXi550-201806401-BG), Workstation (14.x before… Affected: 5.5; 5.5; 5.5; 5.5; 5.5; 5.5; +34 more |
| CVE-2009-2416 | 6.5 | Aug 11 | Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service… Affected: 3.5; 4.0 |
| CVE-2015-6933 | 6.3 | Jan 9 | The VMware Tools HGFS (aka Shared Folders) implementation in VMware Workstation 11.x before 11.1.2, VMware Player 7.x before 7.1.2, VMware Fusion 7.x before 7.1.2, and VMware ESXi… Affected: 5.0; 5.0; 5.0; 5.1; 5.1; 5.5; +1 more |
| CVE-2017-4940 | 6.1 | Dec 20 | The ESXi Host Client in VMware ESXi (6.5 before ESXi650-201712103-SG, 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG) contains a vulnerability that may allow… Affected: 5.5; 5.5; 5.5; 5.5; 5.5; 5.5; +34 more |
| CVE-2016-5331 | 6.1 | Aug 8 | CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting… Affected: 6.0 |
| CVE-2019-5520 | 5.9 | Apr 15 | VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2020-3981 | 5.8 | Oct 20 | VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusion (11.x before 11.5.6) contain an… Affected: 7.0.0; 7.0.0; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2022-21166 | 5.5 | Jun 15 | Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +7 more |
| CVE-2022-21125 | 5.5 | Jun 15 | Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +7 more |
| CVE-2022-21123 | 5.5 | Jun 15 | Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +7 more |
| CVE-2020-3971 | 5.5 | Jun 25 | VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201907101-SG), Workstation (15.x before 15.0.2), and Fusion (11.x before 11.0.2) contain a heap overflow… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2020-3965 | 5.5 | Jun 25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2020-3963 | 5.5 | Jun 25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2020-3958 | 5.5 | May 29 | VMware ESXi (6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), VMware Workstation (15.x before 15.5.2) and VMware Fusion (11.x before 11.5.2) contain a… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2017-4925 | 5.5 | Sep 15 | VMware ESXi 6.5 without patch ESXi650-201707101-SG, ESXi 6.0 without patch ESXi600-201706101-SG, ESXi 5.5 without patch ESXi550-201709101-SG, Workstation (12.x before 12.5.3),… Affected: 5.5; 5.5; 5.5; 5.5; 5.5; 5.5; +34 more |
| CVE-2017-4905 | 5.5 | Jun 7 | VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch… Affected: 5.5; 5.5; 5.5; 5.5; 5.5; 6.0; +7 more |
| CVE-2019-5531 | 5.4 | Sep 18 | VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b,… Affected: 6.7 |
| CVE-2016-7463 | 5.4 | Dec 29 | Cross-site scripting (XSS) vulnerability in the Host Client in VMware vSphere Hypervisor (aka ESXi) 5.5 and 6.0 allows remote authenticated users to inject arbitrary web script or… Affected: 5.5; 6.0 |
| CVE-2020-3995 | 5.3 | Oct 20 | In VMware ESXi (6.7 before ESXi670-201908101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x before 15.1.0), Fusion (11.x before 11.1.0), the VMCI host drivers used by… Affected: 6.7; 6.7; 6.7; 6.7; 6.7; 6.7; +34 more |
| CVE-2020-3976 | 5.3 | Aug 21 | VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2019-5528 | 5.3 | Jul 11 | VMware ESXi 6.5 suffers from partial denial of service vulnerability in hostd process Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2020-3964 | 4.7 | Jun 25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2020-3970 | 3.8 | Jun 25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2022-31699 | 3.3 | Dec 13 | VMware ESXi contains a heap-overflow vulnerability Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2020-3959 | 3.3 | May 29 | VMware ESXi (6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), VMware Workstation (15.x before 15.1.0) and VMware Fusion (11.x before 11.1.0) contain a memory… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2015-1044 | – | Jan 29 | vmware-authd (aka the Authorization process) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allows attackers to cause a… Affected: 5.0; 5.0; 5.0; 5.1; 5.1; 5.5 |
| CVE-2014-8370 | – | Jan 29 | VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allow host OS users to gain host OS… Affected: 5.0; 5.0; 5.0; 5.1; 5.1; 5.5 |
| CVE-2014-4241 | – | Jul 17 | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect integrity via vectors related… Affected: 5.1 |
| CVE-2014-3793 | – | May 31 | VMware Tools in VMware Workstation 10.x before 10.0.2, VMware Player 6.x before 6.0.2, VMware Fusion 6.x before 6.0.3, and VMware ESXi 5.0 through 5.5, when a Windows 8.1 guest OS… Affected: 5.0; 5.0; 5.0; 5.1; 5.1; 5.5 |
| CVE-2014-1208 | – | Jan 17 | VMware Workstation 9.x before 9.0.1, VMware Player 5.x before 5.0.1, VMware Fusion 5.x before 5.0.1, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1 allow guest OS users… Affected: 4.0; 4.0; 4.0; 4.0; 4.0; 4.1; +6 more |
| CVE-2014-1207 | – | Jan 17 | VMware ESXi 4.0 through 5.1 and ESX 4.0 and 4.1 allow remote attackers to cause a denial of service (NULL pointer dereference) by intercepting and modifying Network File Copy… Affected: 4.0; 4.0; 4.0; 4.0; 4.0; 4.1; +6 more |
| CVE-2013-5973 | – | Dec 23 | VMware ESXi 4.0 through 5.5 and ESX 4.0 and 4.1 allow local users to read or modify arbitrary files by leveraging the Virtual Machine Power User or Resource Pool Administrator… Affected: 4.0; 4.0; 4.0; 4.0; 4.0; 4.1; +6 more |
| CVE-2013-3519 | – | Dec 4 | lgtosync.sys in VMware Workstation 9.x before 9.0.3, VMware Player 5.x before 5.0.3, VMware Fusion 5.x before 5.0.4, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1, when… Affected: 4.0; 4.1; 5.0; 5.1 |
| CVE-2013-5970 | – | Oct 21 | hostd-vmdb in VMware ESXi 4.0 through 5.0 and ESX 4.0 through 4.1 allows remote attackers to cause a denial of service (hostd-vmdb service outage) by modifying management traffic Affected: 4.0; 4.1; 5.0 |
| CVE-2013-3658 | – | Sep 10 | Directory traversal vulnerability in VMware ESXi 4.0 through 5.0, and ESX 4.0 and 4.1, allows remote attackers to delete arbitrary host OS files via unspecified vectors Affected: 4.0; 4.0; 4.0; 4.0; 4.0; 4.1; +3 more |
| CVE-2013-3657 | – | Sep 10 | Buffer overflow in VMware ESXi 4.0 through 5.0, and ESX 4.0 and 4.1, allows remote attackers to execute arbitrary code or cause a denial of service via unspecified vectors Affected: 4.0; 4.0; 4.0; 4.0; 4.0; 4.1; +3 more |
| CVE-2013-1661 | – | Sep 4 | VMware ESXi 4.0 through 5.1, and ESX 4.0 and 4.1, does not properly implement the Network File Copy (NFC) protocol, which allows man-in-the-middle attackers to cause a denial of… Affected: 4.0; 4.0; 4.0; 4.0; 4.0; 4.1; +6 more |
| CVE-2013-1659 | – | Feb 22 | VMware vCenter Server 4.0 before Update 4b, 5.0 before Update 2, and 5.1 before 5.1.0b; VMware ESXi 3.5 through 5.1; and VMware ESX 3.5 through 4.1 do not properly implement the… Affected: 3.5; 3.5; 4.0; 4.0; 4.0; 4.0; +16 more |
| CVE-2013-1405 | – | Feb 15 | VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware… Affected: 3.5; 3.5; 4.0; 4.0; 4.0; 4.0; +2 more |