VS
Virtualization
vCenter Server
On CISA KEVExploited in the wildRansomware-linked
86
CVEs
12
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 20High 26Medium 25Low 0
Watch
Add vCenter Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-21993 | 6.5 | Sep 23 | The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content Library Affected: 6.5; 6.7; 7.0 |
| CVE-2021-21992 | 6.5 | Sep 22 | The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2017-4922 | 6.5 | Aug 1 | VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure issue due to the service startup script using world writable directories as temporary storage for… Affected: 6.5 |
| CVE-2009-2416 | 6.5 | Aug 11 | Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service… Affected: 4.0 |
| CVE-2021-22016 | 6.1 | Sep 23 | The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization Affected: 6.7 |
| CVE-2016-5331 | 6.1 | Aug 8 | CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting… Affected: through 6.0 |
| CVE-2015-6931 | 6.1 | Jul 3 | Cross-site scripting (XSS) vulnerability in the vSphere Web Client in VMware vCenter Server 5.0 before U3g, 5.1 before U3d, and 5.5 before U2d allows remote attackers to inject… Affected: 5.0; 5.1; 5.5 |
| CVE-2016-2078 | 6.1 | Jun 8 | Cross-site scripting (XSS) vulnerability in the Web Client in VMware vCenter Server 5.1 before update 3d, 5.5 before update 3d, and 6.0 before update 2 on Windows allows remote… Affected: 5.1; 5.5; 6.0; 5.0 |
| CVE-2019-5538 | 5.9 | Oct 28 | Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +23 more |
| CVE-2019-5537 | 5.9 | Oct 28 | Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +23 more |
| CVE-2022-31697 | 5.5 | Dec 13 | The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2021-22020 | 5.5 | Sep 23 | The vCenter Server contains a denial-of-service vulnerability in the Analytics service Affected: 6.7; 7.0 |
| CVE-2021-22007 | 5.5 | Sep 23 | The vCenter Server contains a local information disclosure vulnerability in the Analytics service Affected: 6.7; 7.0 |
| CVE-2019-5531 | 5.4 | Sep 18 | VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b,… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2017-4926 | 5.4 | Sep 15 | VMware vCenter Server (6.5 prior to 6.5 U1) contains a vulnerability that may allow for stored cross-site scripting (XSS) Affected: 6.5 |
| CVE-2024-37087 | 5.3 | Jun 25 | The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2022-31698 | 5.3 | Dec 13 | The vCenter Server contains a denial-of-service vulnerability in the content library service Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2021-22011 | 5.3 | Sep 23 | vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library Affected: 6.5; 6.7; 7.0 |
| CVE-2020-3976 | 5.3 | Aug 21 | VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +31 more |
| CVE-2024-22275 | 4.9 | May 21 | The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2023-34056 | 4.3 | Oct 25 | vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access… Affected: 4.0 through 5.5; 7.0; 7.0; 7.0; 7.0; 7.0; +32 more |
| CVE-2015-2342 | – | Oct 12 | The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote… Affected: 5.0; 5.1; 5.5; 6.0 |
| CVE-2015-1047 | – | Oct 12 | vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message Affected: 5.0; 5.1; 5.5 |
| CVE-2015-6932 | – | Sep 18 | VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows man-in-the-middle attackers to spoof servers and… Affected: 5.5; 5.5; 5.5; 5.5; 5.5; 5.5; +6 more |
| CVE-2014-4241 | – | Jul 17 | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect integrity via vectors related… Affected: 5.0; 5.1; 5.5 |
| CVE-2013-5971 | – | Oct 21 | Session fixation vulnerability in the vSphere Web Client Server in VMware vCenter Server 5.0 before Update 3 allows remote attackers to hijack web sessions and gain privileges via… Affected: through 5.0; 4.0.0.10021; 4.0.0.12305; 4.1; 4.1.0.12319; 4.1.0.14766; +3 more |
| CVE-2013-1659 | – | Feb 22 | VMware vCenter Server 4.0 before Update 4b, 5.0 before Update 2, and 5.1 before 5.1.0b; VMware ESXi 3.5 through 5.1; and VMware ESX 3.5 through 4.1 do not properly implement the… Affected: 4.0; 4.0; 4.0; 4.0; 4.0; 4.0; +2 more |
| CVE-2012-6326 | – | Feb 22 | VMware vCenter Server 4.1 before Update 3 and 5.0 before Update 2, and vCSA 5.0 before Update 2, allows remote attackers to cause a denial of service (disk consumption) via… Affected: 4.1; 4.1; 4.1; 5.0; 5.0; 5.0; +1 more |
| CVE-2013-1405 | – | Feb 15 | VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware… Affected: 4.0; 4.1 |
| CVE-2011-1789 | – | May 9 | The self-extracting installer in the vSphere Client Installer package in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, VMware ESXi 4.x before 4.1 Update 1, and… Affected: 4.0; 4.0; 4.0; 4.1 |
| CVE-2011-1788 | – | May 9 | vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1 allows local users to discover the SOAP session ID via unspecified vectors Affected: 4.0; 4.0; 4.0; 4.1 |
| CVE-2011-0426 | – | May 9 | Directory traversal vulnerability in vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, and VMware VirtualCenter 2.5 before Update 6a, allows remote… Affected: 4.0; 4.0; 4.0; 4.1 |
| CVE-2010-2928 | – | Feb 16 | The vCenter Tomcat Management Application in VMware vCenter Server 4.1 before Update 1 stores log-on credentials in a configuration file, which allows local users to gain… Affected: 4.1 |
| CVE-2009-3731 | – | Dec 16 | Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0;… Affected: 4.0 |
| CVE-2009-1072 | – | Mar 25 | nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as… Affected: 4.0 |
| CVE-2009-0778 | – | Mar 12 | The icmp_send function in net/ipv4/icmp.c in the Linux kernel before 2.6.25, when configured as a router with a REJECT route, does not properly manage the Protocol Independent… Affected: 4.0 |