VS
Virtualization
vCenter Server
On CISA KEVExploited in the wildRansomware-linked
86
CVEs
12
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 20High 26Medium 25Low 0
Watch
Add vCenter Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-22048 | 8.8 | Nov 10 | The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism Affected: 6.5; 6.7; 7.0 |
| CVE-2017-4921 | 8.8 | Aug 1 | VMware vCenter Server (6.5 prior to 6.5 U1) contains an insecure library loading issue that occurs due to the use of LD_LIBRARY_PATH variable in an unsafe manner Affected: 6.5 |
| CVE-2024-37081 | 7.8 | Jun 18 | The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may… Affected: 8.0; 8.0; 8.0; 8.0; 8.0; 8.0; +34 more |
| CVE-2021-22015 | 7.8 | Sep 23 | The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories Affected: 6.5; 6.7; 7.0 |
| CVE-2021-21991 | 7.8 | Sep 22 | The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2017-4943 | 7.8 | Dec 20 | VMware vCenter Server Appliance (vCSA) (6.5 before 6.5 U1d) contains a local privilege escalation vulnerability via the 'showlog' plugin Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +3 more |
| CVE-2009-2698 | 7.8 | Aug 27 | The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a… Affected: 4.0 |
| CVE-2019-5534 | 7.7 | Sep 18 | VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability where Virtual Machines deployed from… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2019-5532 | 7.7 | Sep 18 | VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability due to the logging of credentials in… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2016-7459 | 7.7 | Dec 29 | VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch setup, or (3)… Affected: 5.0; 5.5; 5.5; 5.5; 5.5; 5.5; +7 more |
| CVE-2016-2076 | 7.6 | Apr 15 | Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before… Affected: through 6.0; 5.5; 5.5; 5.5 |
| CVE-2023-20896 | 7.5 | Jun 22 | The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may… Affected: 4.0 before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +27 more |
| CVE-2022-22982 | 7.5 | Jul 13 | The vCenter Server contains a server-side request forgery (SSRF) vulnerability Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2021-21980 | 7.5 | Nov 24 | The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +29 more |
| CVE-2021-22019 | 7.5 | Sep 23 | The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service Affected: 6.5; 6.7; 7.0 |
| CVE-2021-22013 | 7.5 | Sep 23 | The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API Affected: 6.7; 7.0 |
| CVE-2021-22012 | 7.5 | Sep 23 | The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API Affected: 6.7; 7.0 |
| CVE-2021-22010 | 7.5 | Sep 23 | The vCenter Server contains a denial-of-service vulnerability in VPXD service Affected: 6.7; 7.0 |
| CVE-2021-22009 | 7.5 | Sep 23 | The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service Affected: 6.7; 7.0 |
| CVE-2021-22008 | 7.5 | Sep 23 | The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service Affected: 6.5; 6.7; 7.0 |
| CVE-2021-22006 | 7.5 | Sep 23 | The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI Affected: 6.7; 7.0 |
| CVE-2017-4928 | 7.5 | Nov 17 | The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e Affected: 5.5; 5.5; 5.5; 5.5; 5.5; 5.5; +21 more |
| CVE-2017-4927 | 7.5 | Nov 17 | VMware vCenter Server (6.5 prior to 6.5 U1 and 6.0 prior to 6.0 U3c) does not correctly handle specially crafted LDAP network packets which may allow for remote denial of service Affected: 6.0 before 6.0_u3c; 6.5 before 6.5_u1 |
| CVE-2020-3994 | 7.4 | Oct 20 | VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update function due to a… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +23 more |
| CVE-2024-22274 | 7.2 | May 21 | The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2021-22014 | 7.2 | Sep 23 | The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure) Affected: 6.5; 6.7; 7.0 |
Showing 26