VS
Virtualization
vCenter Server
On CISA KEVExploited in the wildRansomware-linked
86
CVEs
12
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 20High 26Medium 25Low 0
Watch
Add vCenter Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-22948 In wildKEV | 6.5 | Mar 29 | VMware vCenter Server Incorrect Default File Permissions Vulnerability Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2021-22017 In wildKEV | 5.3 | Sep 23 | VMware vCenter Server Improper Access Control Affected: 6.7 |
| CVE-2021-21973 In wildKEV | 5.3 | Feb 24 | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability Affected: 7.x before 7.0 U1c; 6.7 before 6.7 U3l; 6.5 before 6.5 U3n |
| CVE-2021-22018 | 6.5 | Sep 23 | The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in Affected: 7.0 |
| CVE-2021-21993 | 6.5 | Sep 23 | The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content Library Affected: 6.5; 6.7; 7.0 |
| CVE-2021-21992 | 6.5 | Sep 22 | The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2017-4922 | 6.5 | Aug 1 | VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure issue due to the service startup script using world writable directories as temporary storage for… Affected: 6.5 |
| CVE-2009-2416 | 6.5 | Aug 11 | Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service… Affected: 4.0 |
| CVE-2021-22016 | 6.1 | Sep 23 | The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization Affected: 6.7 |
| CVE-2016-5331 | 6.1 | Aug 8 | CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting… Affected: through 6.0 |
| CVE-2015-6931 | 6.1 | Jul 3 | Cross-site scripting (XSS) vulnerability in the vSphere Web Client in VMware vCenter Server 5.0 before U3g, 5.1 before U3d, and 5.5 before U2d allows remote attackers to inject… Affected: 5.0; 5.1; 5.5 |
| CVE-2016-2078 | 6.1 | Jun 8 | Cross-site scripting (XSS) vulnerability in the Web Client in VMware vCenter Server 5.1 before update 3d, 5.5 before update 3d, and 6.0 before update 2 on Windows allows remote… Affected: 5.1; 5.5; 6.0; 5.0 |
| CVE-2019-5538 | 5.9 | Oct 28 | Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +23 more |
| CVE-2019-5537 | 5.9 | Oct 28 | Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +23 more |
| CVE-2022-31697 | 5.5 | Dec 13 | The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2021-22020 | 5.5 | Sep 23 | The vCenter Server contains a denial-of-service vulnerability in the Analytics service Affected: 6.7; 7.0 |
| CVE-2021-22007 | 5.5 | Sep 23 | The vCenter Server contains a local information disclosure vulnerability in the Analytics service Affected: 6.7; 7.0 |
| CVE-2019-5531 | 5.4 | Sep 18 | VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b,… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2017-4926 | 5.4 | Sep 15 | VMware vCenter Server (6.5 prior to 6.5 U1) contains a vulnerability that may allow for stored cross-site scripting (XSS) Affected: 6.5 |
| CVE-2024-37087 | 5.3 | Jun 25 | The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2022-31698 | 5.3 | Dec 13 | The vCenter Server contains a denial-of-service vulnerability in the content library service Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2021-22011 | 5.3 | Sep 23 | vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library Affected: 6.5; 6.7; 7.0 |
| CVE-2020-3976 | 5.3 | Aug 21 | VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +31 more |
| CVE-2024-22275 | 4.9 | May 21 | The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2023-34056 | 4.3 | Oct 25 | vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access… Affected: 4.0 through 5.5; 7.0; 7.0; 7.0; 7.0; 7.0; +32 more |
Showing 25