VMware vCenter Server, VMware Cloud Foundation
19 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2022-31698 | VMware (7.0 prior to 7.0 U3i, 6.7 prior to 6.7.0 U3s, 6.5 prior to 6.5 U3u), VMware Cloud Foundation (4.x, 3.x) | The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port | MEDIUM 5.3 | 48 % | ||
| CVE-2022-31697 | VMware (7.0 prior to 7.0 U3i, 6.7 prior to 6.7.0 U3s, 6.5 prior to 6.5 U3u), VMware Cloud Foundation (4.x, 3.x) | The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with a | MEDIUM 5.5 | 0.1 % | ||
| CVE-2021-22020 | VMware vCenter Server(7.x before 7.0 U2c and 6.7 before 6.7 U3o) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2) | The vCenter Server contains a denial-of-service vulnerability in the Analytics service. Successful exploitation of this issue may allow an a | MEDIUM 5.5 | 0.2 % | ||
| CVE-2021-22019 | VMware vCenter Server(7.x before 7.0 U2c, 6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2) | The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 5 | HIGH 7.5 | 1.6 % | ||
| CVE-2021-22018 | VMware vCenter Server 7.x before 7.0.2 U2d and VMware Cloud Foundation 4.x before 4.3.1 | The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A malicious actor with | MEDIUM 6.5 | 1.1 % | ||
| CVE-2021-22017 | VMware vCenter Server(6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation 3.x before 3.10.2.2 | Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with net | MEDIUM 5.3 | 49 % | KEV | |
| CVE-2021-22016 | VMware vCenter Server 6.7 before 6.7 U3o and VMware Cloud Foundation 3.x before 3.10.2.2 | The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit this | MEDIUM 6.1 | 0.9 % | ||
| CVE-2021-22014 | VMware vCenter Server(7.x before 7.0 U2c, 6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2) | The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). An authenti | HIGH 7.2 | 1.5 % | ||
| CVE-2021-22011 | VMware vCenter Server(7.x before 7.0.2 U2d, 6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation (4.x before 4.3.1 and 3.x before 3.10.2.2) | vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious actor with network acce | MEDIUM 5.3 | 1.1 % | ||
| CVE-2021-22010 | VMware vCenter Server(7.x before 7.0 U2c and 6.7 before 6.7 U3o) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2) | The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter | HIGH 7.5 | 1.7 % | ||
| CVE-2021-22009 | VMware vCenter Server(7.x before 7.0 U2c, 6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2) | The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor with network access | HIGH 7.5 | 1.4 % | ||
| CVE-2021-22008 | VMware vCenter Server(7.x before 7.0 U2c, 6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2) | The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to | HIGH 7.5 | 1.7 % | ||
| CVE-2021-22007 | VMware vCenter Server(7.x before 7.0 U2c and 6.7 before 6.7 U3o) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2) | The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administra | MEDIUM 5.5 | 0.2 % | ||
| CVE-2021-22006 | VMware vCenter Server(7.x before 7.0 U2c and 6.7 before 6.7 U3o) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2) | The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. A malicious actor with network | HIGH 7.5 | 6.6 % | ||
| CVE-2021-22005 | VMware vCenter Server(7.x before 7.0 U2c and 6.7 before 6.7 U3o) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2) | The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 4 | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2021-21993 | VMware vCenter Server(7.x before 7.0 U2c, 6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2) | The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content | MEDIUM 6.5 | 0.9 % | ||
| CVE-2021-22015 | VMware vCenter Server(7.x before 7.0 U2c, 6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2) | The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An aut | HIGH 7.8 | 1.9 % | ||
| CVE-2021-21992 | VMware vCenter Server(7.x before 7.0 U2c, 6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2) | The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing. A malicious actor with non-administrative | MEDIUM 6.5 | 1.0 % | ||
| CVE-2021-21991 | VMware vCenter Server(7.x before 7.0 U2c, 6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2) | The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens. A malicious actor with non- | HIGH 7.8 | 0.3 % |