CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
VMware vCenter Server DCERPC Protocol Out-of-Bounds Write Vulnerability (CVE-2023-34048) Security Advisory
[Affected Scope] VMware vCenter Server 7.0 and 8.0 series, VMware Cloud Foundation 4.x and 5.x series
[Impact] An unauthenticated attacker with network access can trigger an out-of-bounds write, potentially leading to remote code execution (RCE) with administrative privileges
[Mitigation] Apply the official security patches immediately, and restrict network access to the vCenter DCERPC port (default 2012/tcp) using firewalls
VMware vCenter Server Information Disclosure Vulnerability due to Improper File Permissions (CVE-2022-22948) Analysis and Mitigation Guide
[Affected Scope] Unpatched VMware vCenter Server versions 6.5, 6.7, and 7.0
[Impact] A malicious actor with non-administrative or local access can read sensitive configuration files and credentials, potentially leading to full infrastructure compromise
[Mitigation] Apply official VMware security patches (VMSA-2022-0009) immediately, or restrict file permissions on sensitive configuration files as a temporary workaround
VMware vCenter Server Analytics Service Arbitrary File Upload and Remote Code Execution Vulnerability (CVE-2021-22005) Security Advisory
[Affected Scope] VMware vCenter Server versions 6.7 and 7.0 running the Analytics (CEIP) service
[Impact] Unauthenticated attackers with network access to port 443/TCP can upload arbitrary files and execute remote code with system privileges
[Mitigation] Apply official vendor patches immediately, or implement the temporary workaround to disable the vulnerable Analytics endpoint
VMware vCenter Server vSAN Health Check Plugin Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2021-21985)
[Affected Scope] VMware vCenter Server versions 6.5, 6.7, and 7.0 with the default-enabled Virtual SAN Health Check plug-in
[Impact] An unauthenticated attacker with network access to port 443 can execute arbitrary commands with root privileges on the underlying operating system
[Mitigation] Apply official security patches immediately, or disable the vulnerable vSAN Health Check plug-in as a temporary workaround
VMware vCenter Server vSphere Client SSRF Vulnerability (CVE-2021-21973) Security Advisory
[Affected Scope] VMware vCenter Server 7.0, 6.7, 6.5 and VMware Cloud Foundation 4.x, 3.x
[Impact] Unauthenticated attackers with network access to port 443 can trigger SSRF to disclose sensitive internal information
[Mitigation] Apply official security patches immediately or implement workarounds by disabling the vulnerable plugin
VMware vCenter Server vmdir Authentication Bypass and Remote Code Execution Vulnerability (CVE-2020-3952)
[Affected Scope] VMware vCenter Server 6.7 deployments (specifically those upgraded from prior versions) containing an embedded or external Platform Services Controller (PSC).
[Impact] A remote, unauthenticated attacker with network access to vmdir can bypass access controls to extract sensitive directory data or gain full administrative privileges.
[Mitigation] Immediately upgrade vCenter Server to version 6.7 Update 3f or later, and restrict network access to the vmdir service.